| Package | Affected versions | Patched versions |
|---|---|---|
| mysql | = 3.22.26= 3.22.27= 3.22.28= 3.22.29= 3.22.30= 3.22.32= 3.23.10= 3.23.2= 3.23.23= 3.23.24= 3.23.25= 3.23.26= 3.23.27= 3.23.28= 3.23.29= 3.23.3= 3.23.30= 3.23.31= 3.23.34= 3.23.36= 3.23.37= 3.23.38= 3.23.39= 3.23.4= 3.23.40= 3.23.41= 3.23.42= 3.23.43= 3.23.44= 3.23.45= 3.23.46= 3.23.47= 3.23.48= 3.23.49= 3.23.5= 3.23.50= 3.23.51= 3.23.52= 3.23.53= 3.23.53a= 3.23.8= 3.23.9= 4.0.0= 4.0.1= 4.0.2= 4.0.3= 4.0.5a | |
| netbackup advanced reporter | = 3.4= 4.5= 4.5_fp1= 4.5_fp2= 4.5_fp3= 4.5_mp1= 4.5_mp2= 4.5_mp3 | |
| netbackup global data manager | = 4.5= 4.5_fp1= 4.5_fp2= 4.5_fp3= 4.5_mp1= 4.5_mp2= 4.5_mp3 |
The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free