Re: mysql password cracking

[Anders Langworthy <hades () psilanthropy org>]

David Hane wrote:
> I'm wondering how dangerous it is to allow a user on a
> mysql db to view the grants for another user. Could
> they take the encrypted password data and possibly
> crack it? If they can, how easy is it?

If a user can read the password data, it should be possible to do a 
dictionary-type attack against the hashed passwords.  John the Ripper 
has a plugin for MySQL passwords.  The difficulty (time) is dependent 
primarily on the weakness of the passwords used.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html