MySQL Password Length Remote Buffer Overflow Vulnerability
BID:10655
Info
MySQL Password Length Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 10655 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-0627 CVE-2004-0627 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 05 2004 12:00AM |
| Updated: | Jul 06 2016 12:19PM |
| Credit: | Discovery is credited to Chris Anley. |
| Vulnerable: |
MySQL AB MySQL 5.0 .0-alpha MySQL AB MySQL 5.0 .0-0 MySQL AB MySQL 4.1.2 -alpha MySQL AB MySQL 4.1.0.0-alpha MySQL AB MySQL 4.1.0-0 |
| Not Vulnerable: |
MySQL AB MySQL 5.0 MySQL AB MySQL 4.1.3 -beta MySQL AB MySQL 4.1.3 -0 |
Discussion
MySQL Password Length Remote Buffer Overflow Vulnerability
MySQL is prone to a remotely exploitable stack-based buffer overflow vulnerability.
This issue exists in the password checking routines and may be triggered by a malicious authentication packet.
Exploitation will be complicated by the fact that the exploit string will be scrambled with a random number generator and may also require a valid password hash. However, if successfully exploited, the attacker may execute arbitrary code in the context of the server.
This issue is known to exist in MySQL 4.1 releases prior to 4.1.3 and MySQL 5.0.
MySQL is prone to a remotely exploitable stack-based buffer overflow vulnerability.
This issue exists in the password checking routines and may be triggered by a malicious authentication packet.
Exploitation will be complicated by the fact that the exploit string will be scrambled with a random number generator and may also require a valid password hash. However, if successfully exploited, the attacker may execute arbitrary code in the context of the server.
This issue is known to exist in MySQL 4.1 releases prior to 4.1.3 and MySQL 5.0.
Exploit / POC
MySQL Password Length Remote Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
MySQL Password Length Remote Buffer Overflow Vulnerability
Solution:
This issue has been addressed in MySQL 4.1.3 releases. Recent builds of 5.0 reportedly also address this issue, but users are advised to contact the vendor for further details.
MySQL AB MySQL 4.1.0.0-alpha
MySQL AB MySQL 4.1.0-0
MySQL AB MySQL 4.1.2 -alpha
Solution:
This issue has been addressed in MySQL 4.1.3 releases. Recent builds of 5.0 reportedly also address this issue, but users are advised to contact the vendor for further details.
MySQL AB MySQL 4.1.0.0-alpha
-
MySQL AB MySQL 4.1.3
http://dev.mysql.com/downloads/mysql/4.1.html
MySQL AB MySQL 4.1.0-0
-
MySQL AB MySQL 4.1.3
http://dev.mysql.com/downloads/mysql/4.1.html
MySQL AB MySQL 4.1.2 -alpha
-
MySQL AB MySQL 4.1.3
http://dev.mysql.com/downloads/mysql/4.1.html
References
MySQL Password Length Remote Buffer Overflow Vulnerability
References:
References:
- Hackproofing MySQL (NGSSoftware)
- MySQL Authentication Bypass / buffer overflow (NGSSoftware)