Executive Summary
| Summary | |
|---|---|
| Title | New MySQL 4.1 packages fix SQL injection |
| Informations | |||
|---|---|---|---|
| Name | DSA-1092 | First vendor Publication | 2006-06-08 |
| Vendor | Debian | Last vendor Modification | 2006-06-08 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Josh Berkus and Tom Lane discovered that MySQL 4.1, a popular SQL database, incorrectly parses astring escaped with mysql_real_escape() which could lead to SQL injection. This problem does only exist in versions 4.1 and 5.0. The old stable distribution (woody) is not affected by this problem. For the stable distribution (sarge) this problem has been fixed in version 4.1.11a-4sarge4. For the unstable distribution (sid) this problem has been fixed in version 5.0.21-4. Version 4.0 in the stable distribution (sarge) is also not affected by this problem. We recommend that you upgrade your mysql packages. |
Original Source
| Url : http://www.debian.org/security/2006/dsa-1092 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10312 | |||
| Oval ID: | oval:org.mitre.oval:def:10312 | ||
| Title: | SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the mysql_real_escape function is used to escape the input. | ||
| Description: | SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the mysql_real_escape function is used to escape the input. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-2753 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200606-13 (MySQL) File : nvt/glsa_200606_13.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1092-1 (mysql-dfsg-4.1) File : nvt/deb_1092_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2006-155-01 mysql File : nvt/esoft_slk_ssa_2006_155_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 25987 | MySQL Multibyte Encoding SQL Injection Filter Bypass |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-01-16 | Name : The remote database server is vulnerable to a SQL injection attack. File : mysql_5_1_11.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-288-3.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-303-1.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_mysql-1593.nasl - Type : ACT_GATHER_INFO |
| 2007-03-13 | Name : The remote host is missing a Mac OS X update which fixes a security issue. File : macosx_10_4_9.nasl - Type : ACT_GATHER_INFO |
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1092.nasl - Type : ACT_GATHER_INFO |
| 2006-07-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0544.nasl - Type : ACT_GATHER_INFO |
| 2006-06-16 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200606-13.nasl - Type : ACT_GATHER_INFO |
| 2006-06-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0544.nasl - Type : ACT_GATHER_INFO |
| 2006-06-08 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-097.nasl - Type : ACT_GATHER_INFO |
| 2006-06-05 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-155-01.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:25:54 |
|
