Hacker News Reader

Comment by ushi | Hacker News Reader

Whether a particular build of MySQL or MariaDB is vulnerable, depends on how and where it was built. A prerequisite is a memcmp() that can return an arbitrary integer (outside of -128..127 range). To my knowledge gcc builtin memcmp is safe, BSD libc memcmp is safe. Linux glibc sse-optimized memcmp is not safe, but gcc usually uses the inlined builtin version.

How do you know, how the Ubuntu devs compiled their mysql server?

View on HN

Try to connect to MySQL as root with a made-up password several hundred times. If you successfully connect, the bug is present and you know how it was compiled.

where is the perl one-liner :P?

perl -e 'use DBI; for($i=0;$i<4096;$i++){DBI->connect("dbi:mysql:", "root", "nope", {PrintError=>0}) and die "Vulnerable!";}'

Hehe, ok ok.

Well, the Ubuntu part came from HD Moore [1]. I haven't been able to confirm it on my Ubuntu 12.04 virtual machine instance though, nor does my virtual machine appear to trigger the bug using the CVE-2012-2122 checker [2].

But, that is just my single VM instance and I would assume HD Moore knows what he is doing.

[1] http://pastie.org/private/903voijkkz8nmde3yqj4rw

[2] http://pastie.org/4064638

I can confirm. Ubuntu 12.04 LTS (64 bit).

The C script is returning vulnerable on both my local machine (precise) and my vps (Ubuntu 11.10).

However tests of trying to brute force the root password using the mysql one liners in this thread have failed every time.

Both machines allow local access only so I assume I'm safe.

Yep, if you're blocking remote hosts to authenticate on 3306 (or any other port you're running mysqld on) you're safe. The attacking host can't authenticate itself, so it's unable to exploit this bug.

Reply on news.ycombinator.com