Category: Security
-
Who are you? The history of MySQL and MariaDB authentication protocols from 1997 to 2017
MySQL 3.20 to 4.0
In the good old days, when 32MB of RAM justified the name my-huge.cnf, when nobody knew Google and Facebook didn’t even exist, security was… how do I put it… kind of cute. Computer viruses didn’t steal millions and didn’t disrupt elections — they played Yankee Doodle or told you not to play with the PC. People used telnet and ftp, although some security conscious admins already knew ssh.
Somewhere around this time, give or take a […]
-
MariaDB Server versions and the Remote Root Code Execution Vulnerability CVE-2016-6662
During the recent days there has been quite a lot of questions and discussion around a vulnerability referred to as MySQL Remote Root Code Execution / Privilege Escalation 0day with CVE code CVE-2016-6662. It’s a serious vulnerability and we encourage every MariaDB Server user to read the below update on the vulnerability from a MariaDB point of view.
The vulnerability can be exploited by both local and remote users. Both an authenticated connection to or SQL injection in an affected […]
-
MariaDB itself is NOT affected by the DROWN vulnerability
Recently a serious vulnerability called DROWN was found. The vulnerability exists in systems that support SSLv2. There is flaw in SSLv2 that could be used to decrypt information over newer SSL protocols such as TLS. More information about the DROWN vulnerability with CVE number CVE-2016-0800 can be found here: