Description
The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | mysql | 3.23.49-8.2 | DSA-212 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- MySQL 3.23.x/4.0.x - 'COM_CHANGE_USER' Password Length Account EDB-22084 · remote · Dec 16, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-212 mysql - multiple problems Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20021212 Advisory 04/2002: Multiple MySQL vulnerabilities mailing-list
- 20021216 [OpenPKG-SA-2002.013] OpenPKG Security Advisory (mysql) mailing-list
- CLSA-2002:555 vendor-advisory
- ESA-20021213-033 vendor-advisory
- http://security.e-matters.de/advisories/042002.html
- DSA-212 vendor-advisory
- RHSA-2002:288 vendor-advisory
- MDKSA-2002:087 vendor-advisory
- RHSA-2003:166 vendor-advisory
- mysql-comchangeuser-password-bypass(10847) vdb-entry
- GLSA-200212-2 vendor-advisory
- SUSE-SA:2003:003 vendor-advisory
- RHSA-2002:289 vendor-advisory
- 2002-0086 vendor-advisory
- 6373 vdb-entry
- IMNX-2003-7+-008-01 vendor-advisory