CVE-2012-2122
Oracle MySQL/MariaDB SQL Heap-Based Buffer Overflow Authentication Bypass
Description
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.
INFO
Published Date :
June 26, 2012, 6:55 p.m.
Last Modified :
Nov. 21, 2024, 1:38 a.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
6.4
Exploitability Score :
4.9
Public PoC/Exploit Available at Github
CVE-2012-2122 has a 29 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2012-2122.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
"Walkthrough for Metasploitable-2"
基于Docker-Compose的预构建漏洞环境设计源码 Docker-Compose 漏洞环境 Java Python Shell 该项目是一套基于Docker-Compose的预构建漏洞环境设计源码，涵盖了1684个文件，其中包括405个PNG图像文件、319个Markdown文档、218个YAML配置文件、68个Java源文件、67个Python脚本、62个Shell脚本、53个XML文件、34个PHP文件以及多个Dockerfile。该环境集成了Java, Python, Shell, PHP, HTML, JavaScript, CSS, Ruby等多种编程语言，旨在为安全研究提供易用的漏洞测试平台。
基于Python主导的Python、C、Java多语言知识库设计源码 Python 知识库 C语言 Java 多语言开发 该项目是以Python为核心，融合Python、C和Java语言的综合性知识库设计源码，总计包含211个文件，涵盖79个PNG图片文件、58个Markdown文件、53个Python脚本文件、4个XML文件、3个JPG文件、3个C语言文件、2个Java文件、2个CSV文件、2个文本文件、1个Git忽略文件。此知识库为李永健个人定制，旨在整理和存储各类编程知识和技术资料。
A curated collection of Proof of Concept (PoC) tools, scripts, and techniques designed for red team operations, penetration testing, and cybersecurity research. This repository focuses on providing practical resources for exploring vulnerabilities
attack cybersecurity exp hw penetration-testing poc red-team security-tools vulnerability-poc
يركز هذا المستودع على تقديم اساسيات اداة (نماب)باللغة العربية للمبتدئين
Nmap on crack using py
Python
日积月累 漏洞库
None
日积月累 漏洞库
None
Go
None
🐳 docker-compose 를 활용한 취약한 환경 구성 및 검증 (vulhub 한글판)
docker docker-compse vulnerability-environment
Python
在公网收集的gobypoc+部分自己加的poc
cve扫描脚本
Python
...
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2012-2122 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2012-2122 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference http://bugs.mysql.com/bug.php?id=64884 Added Reference http://kb.askmonty.org/en/mariadb-5162-release-notes/ Added Reference http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html Added Reference http://seclists.org/oss-sec/2012/q2/493 Added Reference http://secunia.com/advisories/49417 Added Reference http://secunia.com/advisories/53372 Added Reference http://security.gentoo.org/glsa/glsa-201308-06.xml Added Reference http://securitytracker.com/id?1027143 Added Reference http://www.exploit-db.com/exploits/19092 Added Reference http://www.securityfocus.com/bid/53911 Added Reference https://community.rapid7.com/community/metasploit/blog/2012/06/11/cve-2012-2122-a-tragically-comedic-security-flaw-in-mysql -
CVE Modified by [email protected]
May. 14, 2024
Action Type Old Value New Value -
Initial Analysis by [email protected]
Jun. 27, 2012
Action Type Old Value New Value
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2012-2122 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2012-2122
weaknesses.
Exploit Prediction
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.
95.70 }} -1.09%
score
0.99575
percentile