MySQL Weak Hash Algorithm

medium Nessus Plugin ID 17824

Language:

Synopsis

Passwords could be brute-forced on the remote database server.

Description

The version of MySQL installed on the remote host is older than 4.1.1. As such, it reportedly uses a weak algorithm to hash the passwords. A attacker who can read the mysql.user table will be able to retrieve the plaintext passwords quickly by brute-force attack.

Solution

Upgrade to MySQL version 4.1.1 or later.

Plugin Details

Severity: Medium

ID: 17824

File Name: mysql_4_1.nasl

Version: 1.6

Type: remote

Family: Databases

Published: 1/18/2012

Updated: 7/16/2018

Configuration: Enable paranoid mode

Supported Sensors: Frictionless Assessment Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: cpe:/a:mysql:mysql

Required KB Items: Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 5/5/2003

Reference Information

CVE: CVE-2003-1480

BID: 7500

CWE: 310

Detections

Analytics