As mysql is a widely used sql platform, i strongly advise everyone using it to read it, and fix where appropriate. This email has been bcc'd to the mysql bug list, and other appropriate parties. There exists a vulnerability in the password checking routines in the latest versions of the MySQL server, that allows any user on a host that is allowed to connect to the server, to skip password authentication, and access databases.
All versions are vulnerable on all platforms.
On connection a random string is generated and sent to the client. The client generates a new string with a random generator inited with the hash values from the password and the sent string. Of course the server should notice the check string is not the same length as the check string needed, and give a password error. Because no such checks are done, when a check string of length 1 is passed to the server, only one character is compared. So the only thing that remains to know if we want to peek in someone's MySQL database, is a technique to find out the first character of the server-side check string.