CVE-2012-5615

What it actually does

The vulnerability causes the MySQL/MariaDB server to produce distinguishable error messages and measurable response time differences during authentication attempts based on whether the supplied username exists in the user table.

Why it matters to the business

Attackers can discover valid database accounts without credentials, simplifying targeted credential attacks that may result in data theft, unauthorized modifications, or service disruption.

How an attack unfolds

An attacker connects to the exposed database port and issues repeated authentication requests using lists of candidate usernames, measuring both the exact error text returned and the elapsed time for each response to build a map of valid accounts before attempting password guessing against those accounts.

How to fix it

Upgrade affected MySQL installations to versions later than 5.5.38 and 5.6.19 and affected MariaDB installations to versions later than 5.5.28a, 5.3.11, 5.2.13 and 5.1.66; alternatively restrict network access to the database port and enforce account lockout policies.

How to confirm the fix worked

Perform controlled authentication probes using both known-valid and known-invalid usernames from an external host and confirm that all responses exhibit identical timing and identical error text regardless of username existence.

Typical attack path

1. Connect to the MySQL/MariaDB listener from a remote host
2. Submit authentication packets containing guessed usernames
3. Record response latency and error string for each attempt
4. Filter results to retain only usernames that produce the distinct valid-user signature
5. Launch password brute-force or dictionary attacks against the confirmed accounts

How to detect it

Examine database error logs and network flow data for clusters of authentication failures that target many different usernames from the same source IP within a short time window; correlate with any subsequent successful logins from the same source.

• Access denied for user
• repeated authentication failures from single remote IP
• high volume of distinct usernames in auth logs

What your security team should do

• Block or tightly restrict inbound connections to database ports from untrusted networks
• Implement rate limiting and account lockout on database authentication
• Deploy monitoring for high volumes of failed logins originating from single sources
• Schedule upgrades to current supported releases of MySQL or MariaDB