After exploiting the vulnerability, the module copies the MySQL server’s master user table, which contains all password hashes. An attacker can crack the password hashes using dictionary attacks ...

But in the affected versions of MariaDB and MySQL, as MontyProgram's Sergei Golubchik wrote in a list posting on June 9, the database can be fooled into accepting a password even if it doesn't match.

After exploiting the vulnerability, the module copies the MySQL server’s master user table, which contains all password hashes. An attacker can crack the password hashes using dictionary attacks ...

In this case MySQL/MariaDB would think that the password is correct, even while it is not. Because the protocol uses random strings, the probability of hitting this bug is about 1/256.

Oracle’s MySQL.com customer website was apparently compromised over the weekend by a pair of hackers who publicly posted usernames, and in some cases passwords, of the site’s users. Taking ...

If MySQL was built on such a system, the code that compares the cryptographic hash of a user-inputted password to the hash stored in the database for a particular account will sometimes allow ...

If MySQL was built on such a system, the code that compares the cryptographic hash of a user-inputted password to the hash stored in the database for a particular account will sometimes allow ...