PUBLISHED DATE: January 19, 2001CVE-2001-1275:
MySQL before 3.23.31 allows...

Description

MySQL before 3.23.31 allows users with a MySQL account to use the SHOW GRANTS command to obtain the encrypted administrator password from the mysql.user table and possibly gain privileges via password cracking.

Products

• Oracle MySQL
• Oracle MySQL -
• Oracle MySQL 1.5.1
• Oracle MySQL 3.20.32a
• Oracle MySQL 3.20
• Oracle MySQL 3.21
• Oracle MySQL 3.22.26
• Oracle MySQL 3.22.27
• Oracle MySQL 3.22.28
• Oracle MySQL 3.22.29
• Oracle MySQL 3.22.30
• Oracle MySQL 3.22.32
• Oracle MySQL 3.22
• Oracle MySQL 3.23.0 Alpha
• Oracle MySQL 3.23.10
• Oracle MySQL 3.23.11
• Oracle MySQL 3.23.12
• Oracle MySQL 3.23.13
• Oracle MySQL 3.23.14
• Oracle MySQL 3.23.15
• Oracle MySQL 3.23.16
• Oracle MySQL 3.23.17
• Oracle MySQL 3.23.18
• Oracle MySQL 3.23.19
• Oracle MySQL 3.23.1
• Oracle MySQL 3.23.20 Beta
• Oracle MySQL 3.23.21
• Oracle MySQL 3.23.22
• Oracle MySQL 3.23.23
• Oracle MySQL 3.23.24
• Oracle MySQL 3.23.25
• Oracle MySQL 3.23.26
• Oracle MySQL 3.23.27
• Oracle MySQL 3.23.28
• Oracle MySQL 3.23.28 Gamma
• Oracle MySQL 3.23.29
• Oracle MySQL 3.23.2
• Oracle MySQL 3.23.30
• Oracle MySQL 3.23.31
• Oracle MySQL 3.23.3
• Oracle MySQL 3.23.4
• Oracle MySQL 3.23.5
• Oracle MySQL 3.23.6
• Oracle MySQL 3.23.7
• Oracle MySQL 3.23.8
• Oracle MySQL 3.23.9
• Oracle MySQL 3.23

Questions to Ask Vendors

1. Can you confirm whether your systems are affected by CVE-2001-1275, and if so, what steps are you currently taking to mitigate this vulnerability?
2. What is your estimated timeline for fully resolving CVE-2001-1275 in your products or services, and how will you communicate updates on this issue to us as your customer?

Recommended Actions

• Check out the advisory links provided below.

References

• https://nvd.nist.gov/vuln/detail/CVE-2001-1275