Executive Summary
| Summary | |
|---|---|
| Title | New mysql packages fix buffer overflow |
| Informations | |||
|---|---|---|---|
| Name | DSA-381 | First vendor Publication | 2003-09-13 |
| Vendor | Debian | Last vendor Modification | 2003-09-13 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| MySQL, a popular relational database system, contains a buffer overflow condition which could be exploited by a user who has permission to execute "ALTER TABLE" commands on the tables in the "mysql" database. If successfully exploited, this vulnerability could allow the attacker to execute arbitrary code with the privileges of the mysqld process (by default, user "mysql"). Since the "mysql" database is used for MySQL's internal record keeping, by default the mysql administrator "root" is the only user with permission to alter its tables. For the stable distribution (woody) this problem has been fixed in version 3.23.49-8.5. For the unstable distribution (sid) this problem will be fixed soon. Refer to Debian bug #210403. We recommend that you update your mysql package. |
Original Source
| Url : http://www.debian.org/security/2003/dsa-381 |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-01-17 | Name : Debian Security Advisory DSA 381-1 (mysql) File : nvt/deb_381_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 2537 | MySQL sql_acl.cc get_salt_from_password Function Password Handling Remote Ove... A remote buffer overflow exists in MySQL. MySQL fails to validate the length of the user-supplied password in the MySQL's user table. If an authenticated attacker with the "alter database" privilege alters any user's password to a value longer longer than 16 characters, a buffer overflow occurs. With a specially crafted request, an attacker can cause the execution of arbitrary code resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2004-11-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2003-282.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-381.nasl - Type : ACT_GATHER_INFO |
| 2004-07-31 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2003-094.nasl - Type : ACT_GATHER_INFO |
| 2003-09-19 | Name : The remote database server is susceptible to a buffer overflow attack. File : mysql_password_overflow.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:32:53 |
|
