News
Vigil@nce - MySQL: Man-in-the-Middle of TLS
June 2015 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can act as a Man-in-the-Middle when the MySQL client
asks for a TLS session, in order to read or alter exchanged data.
– Impacted products: MySQL Community, MySQL Enterprise, Percona
Server, XtraDB Cluster
– Severity: 2/4
– Creation date: 29/04/2015
DESCRIPTION OF THE VULNERABILITY
The MySQL client can communicate with the server through a TLS
session.
The "—ssl" option of the client tries to setup a TLS session, but
does not require it. This behavior is documented, however many
administrators are not aware of this behavior.
An attacker can therefore act as a Man-in-the-Middle when the
MySQL client asks for a TLS session, in order to read or alter
exchanged data.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/MySQL-Man-in-the-Middle-of-TLS-16761
