Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-0227 | First vendor Publication | 2008-01-10 |
| Vendor | Cve | Last vendor Modification | 2018-10-15 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allows remote attackers to cause a denial of service (crash) via a Hello packet containing a large size value, which triggers a buffer over-read in the HASHwithTransform::Update function in hash.cpp. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0227 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17775 | |||
| Oval ID: | oval:org.mitre.oval:def:17775 | ||
| Title: | USN-588-1 -- mysql-dfsg-5.0 vulnerabilities | ||
| Description: | Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-588-1 CVE-2006-7232 CVE-2007-2692 CVE-2007-6303 CVE-2008-0226 CVE-2008-0227 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 | Product(s): | mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17802 | |||
| Oval ID: | oval:org.mitre.oval:def:17802 | ||
| Title: | USN-588-2 -- mysql-dfsg-5.0 regression | ||
| Description: | USN-588-1 fixed vulnerabilities in MySQL. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-588-2 CVE-2007-2692 CVE-2006-7232 CVE-2007-6303 CVE-2008-0226 CVE-2008-0227 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 | Product(s): | mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:19935 | |||
| Oval ID: | oval:org.mitre.oval:def:19935 | ||
| Title: | DSA-1478-1 mysql-dfsg-5.0 - buffer overflows | ||
| Description: | Luigi Auriemma discovered two buffer overflows in YaSSL, an SSL implementation included in the MySQL database package, which could lead to denial of service and possibly the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1478-1 CVE-2008-0226 CVE-2008-0227 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8173 | |||
| Oval ID: | oval:org.mitre.oval:def:8173 | ||
| Title: | DSA-1478 mysql-dfsg-5.0 -- buffer overflows | ||
| Description: | Luigi Auriemma discovered two buffer overflows in YaSSL, an SSL implementation included in the MySQL database package, which could lead to denial of service and possibly the execution of arbitrary code. The old stable distribution (sarge) doesn't contain mysql-dfsg-5.0. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1478 CVE-2008-0226 CVE-2008-0227 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-05-12 | Name : Mac OS X Security Update 2008-007 File : nvt/macosx_secupd_2008-007.nasl |
| 2009-04-09 | Name : Mandriva Update for mysql MDVSA-2008:150 (mysql) File : nvt/gb_mandriva_MDVSA_2008_150.nasl |
| 2009-03-23 | Name : Ubuntu Update for mysql-dfsg-5.0 vulnerabilities USN-588-1 File : nvt/gb_ubuntu_USN_588_1.nasl |
| 2009-03-23 | Name : Ubuntu Update for mysql-dfsg-5.0 regression USN-588-2 File : nvt/gb_ubuntu_USN_588_2.nasl |
| 2008-01-31 | Name : Debian Security Advisory DSA 1478-1 (mysql-dfsg-5.0) File : nvt/deb_1478_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 41197 | yaSSL hash.cpp HASHwithTransform::Update Function Hello Packet Overflow DoS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-01-16 | Name : Arbitrary code can be executed on the remote database server. File : mysql_6_0_4_yaSSL.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-150.nasl - Type : ACT_GATHER_INFO |
| 2008-10-10 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-007.nasl - Type : ACT_GATHER_INFO |
| 2008-09-11 | Name : The remote database server is affected by several issues. File : mysql_5_0_67.nasl - Type : ACT_GATHER_INFO |
| 2008-04-04 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-588-2.nasl - Type : ACT_GATHER_INFO |
| 2008-03-21 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-588-1.nasl - Type : ACT_GATHER_INFO |
| 2008-01-30 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1478.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:06:58 |
|
| 2021-04-22 01:07:27 |
|
| 2020-05-23 01:38:58 |
|
| 2020-05-23 00:21:06 |
|
| 2018-10-16 00:19:25 |
|
| 2017-08-08 09:23:48 |
|
| 2016-04-26 17:00:54 |
|
| 2014-02-17 10:43:25 |
|
| 2013-05-11 00:06:41 |
|
