CVE-2012-5627

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2012/Dec/58Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2012/Dec/83Exploit, Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2012/q4/424Mailing List, Third Party Advisory
http://secunia.com/advisories/53372Not Applicable
http://security.gentoo.org/glsa/glsa-201308-06.xmlPatch, Third Party Advisory, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=883719Issue Tracking, Patch, Third Party Advisory
https://mariadb.atlassian.net/browse/MDEV-3915Broken Link, Vendor Advisory
http://seclists.org/fulldisclosure/2012/Dec/58Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2012/Dec/83Exploit, Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2012/q4/424Mailing List, Third Party Advisory
http://secunia.com/advisories/53372Not Applicable
http://security.gentoo.org/glsa/glsa-201308-06.xmlPatch, Third Party Advisory, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=883719Issue Tracking, Patch, Third Party Advisory
https://mariadb.atlassian.net/browse/MDEV-3915Broken Link, Vendor Advisory

Timeline

Published: Oct 1, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-56284.4gofer before 0.68 uses world-writable permissions for /var/lib/gofer/journal/watchdog, which allows local users to cause a denial of service CVE-2012-56297.5The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CVE-2012-56306.3libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.CVE-2012-56318.8ipa 3.0 does not properly check server identity before sending credential containing cookies CVE-2012-56335.8The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasse CVE-2012-56346.1Xen 4.2.x, 4.1.x, and 4.0, when using Intel VT-d for PCI passthrough, does not properly configure VT-d when supporting a device that is behi CVE-2012-56352.1The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitra CVE-2012-56366.1Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote CVE-2012-56383.6The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwri CVE-2012-56396.5LibreOffice and OpenOffice automatically open embedded content CVE-2012-56405.5thttpd has a local DoS vulnerability via specially-crafted .htpasswd files CVE-2012-56415.0Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before