1
0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Files
mariadb/sql
Anirudh Mangipudi 18079ac9b8 Bug #17357535 BACKPORT BUG#16241992 TO 5.5
Problem:
COM_CHANGE_USER allows brute-force attempts to crack a password at a very high
rate as it does not cause any significant delay after a login attempt has
failed. This issue was reproduced using John-The-Ripper password
cracking tool through which about 5000 passwords per second could be attempted.

Solution:
The non-GA version's solution was to disconnect the connection when a login
attempt failed. Now since our aim to to reduce the rate at which passwords 
are tested, we introduced a sleep(1) after every login attempt failed. This
significantly increased the delay with which the password was cracked.
2013-10-18 17:14:39 +05:30
..
2011-06-30 17:31:31 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-05-21 10:21:08 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2013-02-25 15:26:00 +01:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-07-04 01:25:49 +02:00
2011-06-30 17:46:53 +02:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2013-04-14 08:09:56 +05:30
2013-03-28 19:17:28 +05:30
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-07-03 17:47:37 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-02-16 10:48:16 +01:00
2012-02-16 10:48:16 +01:00
2012-02-16 10:48:16 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-02-16 10:48:16 +01:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2013-03-28 17:41:22 +02:00
2013-03-28 17:41:22 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-09-12 08:59:44 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2012-10-12 22:59:21 +02:00
2013-02-25 15:26:00 +01:00
2011-11-17 09:00:58 +01:00
2010-12-07 16:11:13 +00:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2013-02-25 15:26:00 +01:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-07-04 01:25:49 +02:00
2012-09-22 18:07:04 +05:30
2012-02-16 10:48:16 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2013-02-25 15:26:00 +01:00
2011-06-30 17:46:53 +02:00
2011-06-30 17:46:53 +02:00
2011-07-04 01:25:49 +02:00