MySQL Mysql_real_connect Function Potential Remote Buffer Overflow Vulnerability

BID:10981

Info

MySQL Mysql_real_connect Function Potential Remote Buffer Overflow Vulnerability

Bugtraq ID: 10981
Class: Boundary Condition Error
CVE: CVE-2004-0836
Remote: Yes
Local: No
Published: Aug 20 2004 12:00AM
Updated: Jul 12 2009 06:17AM
Credit: Discovery is credited to Lukasz Wojtow.
Vulnerable: Ubuntu Ubuntu Linux 4.1 ppc
Ubuntu Ubuntu Linux 4.1 ia64
Ubuntu Ubuntu Linux 4.1 ia32
Trustix Secure Linux 2.1
Trustix Secure Linux 2.0
Trustix Secure Linux 1.5
Trustix Secure Enterprise Linux 2.0
SuSE Linux 8.1
SuSE Linux 8.0
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 9.1
S.u.S.E. Linux Personal 9.0 x86_64
S.u.S.E. Linux Personal 9.0
S.u.S.E. Linux Personal 8.2
Redhat Fedora Core1
Redhat Enterprise Linux WS 3
Redhat Enterprise Linux ES 3
Redhat Enterprise Linux AS 3
Redhat Desktop 3.0
OpenPKG OpenPKG 2.2
OpenPKG OpenPKG 2.1
OpenPKG OpenPKG Current
MySQL AB MySQL 5.0 .0-alpha
MySQL AB MySQL 5.0 .0-0
MySQL AB MySQL 4.1.3 -beta
MySQL AB MySQL 4.1.3 -0
MySQL AB MySQL 4.1.2 -alpha
MySQL AB MySQL 4.0.20
+ Mandriva Linux Mandrake 10.1 x86_64
 + Mandriva Linux Mandrake 10.1
+ Ubuntu Ubuntu Linux 4.1 ppc
 + Ubuntu Ubuntu Linux 4.1 ia64
 + Ubuntu Ubuntu Linux 4.1 ia32
 MySQL AB MySQL 4.0.18
+ MandrakeSoft Corporate Server 3.0 x86_64
 + MandrakeSoft Corporate Server 3.0
+ Mandriva Linux Mandrake 10.0 AMD64
 + Mandriva Linux Mandrake 10.0
MySQL AB MySQL 4.0.15
MySQL AB MySQL 4.0.14
MySQL AB MySQL 4.0.13
MySQL AB MySQL 4.0.12
MySQL AB MySQL 4.0.11 -gamma
MySQL AB MySQL 4.0.11
+ Mandriva Linux Mandrake 9.1 ppc
 + Mandriva Linux Mandrake 9.1
MySQL AB MySQL 4.0.10
MySQL AB MySQL 4.0.9 -gamma
MySQL AB MySQL 4.0.9
MySQL AB MySQL 4.0.8 -gamma
MySQL AB MySQL 4.0.8
MySQL AB MySQL 4.0.7 -gamma
MySQL AB MySQL 4.0.7
MySQL AB MySQL 4.0.6
MySQL AB MySQL 4.0.5 a
MySQL AB MySQL 4.0.5
MySQL AB MySQL 4.0.4
MySQL AB MySQL 4.0.3
MySQL AB MySQL 4.0.2
MySQL AB MySQL 4.0.1
MySQL AB MySQL 4.0 .0
MySQL AB MySQL 3.23.58
+ Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux WS 2.1
 + Redhat Fedora Core2
 + Redhat Linux Advanced Work Station 2.1
+ Sun Linux 5.0.7
+ Sun Linux 5.0.6
+ Sun Linux 5.0.5
+ Sun Linux 5.0.3
+ Sun Linux 5.0
+ Turbolinux Appliance Server 1.0 Workgroup Edition
 + Turbolinux Appliance Server 1.0 Hosting Edition
 + Turbolinux Appliance Server Hosting Edition 1.0
+ Turbolinux Appliance Server Workgroup Edition 1.0
+ Turbolinux Home
+ Turbolinux Turbolinux Desktop 10.0
+ Turbolinux Turbolinux Server 8.0
+ Turbolinux Turbolinux Workstation 8.0
MySQL AB MySQL 3.23.56
MySQL AB MySQL 3.23.55
MySQL AB MySQL 3.23.54 a
+ OpenPKG OpenPKG 1.2
+ OpenPKG OpenPKG Current
 + Redhat Linux 9.0 i386
 MySQL AB MySQL 3.23.54
+ Sun Cobalt RaQ 550
+ Trustix Secure Linux 1.5
MySQL AB MySQL 3.23.53 a
MySQL AB MySQL 3.23.53
+ OpenPKG OpenPKG Current
 + Sun Cobalt Qube 3
MySQL AB MySQL 3.23.52
+ Conectiva Linux Enterprise Edition 1.0
+ Mandriva Linux Mandrake 9.0
+ OpenPKG OpenPKG 1.1
+ Redhat Linux 8.0 i386
 + Redhat Linux 8.0
+ SuSE Linux 8.1
+ Trustix Secure Linux 1.5
MySQL AB MySQL 3.23.51
MySQL AB MySQL 3.23.50
MySQL AB MySQL 3.23.49
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Redhat Linux 7.3 i686
 + Redhat Linux 7.3 i386
 + Redhat Linux 7.3
MySQL AB MySQL 3.23.48
MySQL AB MySQL 3.23.47
MySQL AB MySQL 3.23.46
MySQL AB MySQL 3.23.45
MySQL AB MySQL 3.23.44
+ SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3 i386
 + SuSE Linux 7.3
MySQL AB MySQL 3.23.43
MySQL AB MySQL 3.23.42
MySQL AB MySQL 3.23.41
MySQL AB MySQL 3.23.40
MySQL AB MySQL 3.23.39
MySQL AB MySQL 3.23.38
MySQL AB MySQL 3.23.37
MySQL AB MySQL 3.23.36
+ EnGarde Secure Linux 1.0.1
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i686
 + Redhat Linux 7.1 i586
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1
MySQL AB MySQL 3.23.34
- Debian Linux 2.2 sparc
 - Debian Linux 2.2 powerpc
 - Debian Linux 2.2 arm
 - Debian Linux 2.2 alpha
 - Debian Linux 2.2 68k
 - Debian Linux 2.2
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 3.5.1
- HP HP-UX 11.11
- HP HP-UX 11.0
- IBM AIX 4.3.3
- IBM AIX 4.3.2
- Mandriva Linux Mandrake 7.2
- Mandriva Linux Mandrake 7.1
- Mandriva Linux Mandrake 7.0
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.6
- Redhat Linux 7.0 i386
 - Redhat Linux 7.0 alpha
 - Redhat Linux 6.2 sparc
 - Redhat Linux 6.2 i386
 - Redhat Linux 6.2 alpha
 - Redhat Linux 5.2 sparc
 - Redhat Linux 5.2 i386
 - Redhat Linux 5.2 alpha
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 - SuSE Linux 7.1
- SuSE Linux 7.0
- SuSE Linux 6.4
MySQL AB MySQL 3.23.33
+ SuSE Linux 7.1 x86
 + SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 alpha
 + SuSE Linux 7.1
MySQL AB MySQL 3.23.32
+ Wirex Immunix OS 7+
 MySQL AB MySQL 3.23.31
+ MandrakeSoft Single Network Firewall 7.2
+ Mandriva Linux Mandrake 7.2
MySQL AB MySQL 3.23.30
MySQL AB MySQL 3.23.29
MySQL AB MySQL 3.23.28 gamma
MySQL AB MySQL 3.23.28
MySQL AB MySQL 3.23.27
MySQL AB MySQL 3.23.26
MySQL AB MySQL 3.23.25
MySQL AB MySQL 3.23.24
MySQL AB MySQL 3.23.23
MySQL AB MySQL 3.23.22
+ Redhat Linux 7.0 sparc
 + Redhat Linux 7.0 alpha
 + Redhat Linux 7.0
MySQL AB MySQL 3.23.10
MySQL AB MySQL 3.23.9
MySQL AB MySQL 3.23.8
MySQL AB MySQL 3.23.5
+ MandrakeSoft Corporate Server 2.1 x86_64
 + MandrakeSoft Corporate Server 2.1
+ Trustix Secure Linux 1.5
MySQL AB MySQL 3.23.4
MySQL AB MySQL 3.23.3
- FreeBSD FreeBSD 5.0
- FreeBSD FreeBSD 4.0
MySQL AB MySQL 3.23.2
MySQL AB MySQL 3.23 .x
MySQL AB MySQL 3.22.32
+ Debian Linux 2.2 sparc
 + Debian Linux 2.2 powerpc
 + Debian Linux 2.2 IA-32
 + Debian Linux 2.2 arm
 + Debian Linux 2.2 alpha
 + Debian Linux 2.2 68k
 MySQL AB MySQL 3.22.30
MySQL AB MySQL 3.22.29
MySQL AB MySQL 3.22.28
MySQL AB MySQL 3.22.27
MySQL AB MySQL 3.22.26
MySQL AB MySQL 3.22 .x
MySQL AB MySQL 3.21 .x
MySQL AB MySQL 3.20.32 a
MySQL AB MySQL 3.20 .x
MySQL AB MySQL 4.1.0.0-alpha
MySQL AB MySQL 4.1.0-0
Mandriva Linux Mandrake 10.1 x86_64
Mandriva Linux Mandrake 10.1
Mandriva Linux Mandrake 10.0 AMD64
Mandriva Linux Mandrake 10.0
Mandriva Linux Mandrake 9.2 amd64
Mandriva Linux Mandrake 9.2
MandrakeSoft Corporate Server 2.1 x86_64
MandrakeSoft Corporate Server 2.1
Not Vulnerable:

Discussion

MySQL Mysql_real_connect Function Potential Remote Buffer Overflow Vulnerability

MySQL is prone to a potential remote buffer overflow vulnerability. This issue occurs due to insufficient boundary checks performed by the 'mysql_real_connect' function.

The 'mysql_real_connect' function does not verify the length of the IP address returned through a DNS response from a server. Immediate consequences of an attack may result in a denial of service condition. It is conjectured that this issue could allow for arbitrary code execution, however, this has not been confirmed.

It is also reported that the glibc library verifies the length of an IP address, however, other libraries may obtain the length from a DNS response packet. Computers using glibc on Linux and BSD platforms may not be vulnerable to this issue.

Exploit / POC

MySQL Mysql_real_connect Function Potential Remote Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

MySQL Mysql_real_connect Function Potential Remote Buffer Overflow Vulnerability

Solution:
The vendor has reported that this issue will be addressed in the next release (4.0.21) of MySQL.

Conectiva Linux has released advisory CLA-2004:892 along with fixes to address this and other issues. Please see the referenced advisory for further information.

Debian has issued an advisory for this and other MySQL vulnerabilities. See DSA 562-1 in the reference section.

Trustix Secure Linux has released advisory TSLSA-2004-0054 along with fixes to address this issue. Please see the referenced advisory for further information.

Gentoo has released an advisory (GLSA 200410-22) to address various issues in MySQL. Please see the referenced advisory for more information. Gentoo users may carry out the following actions to update their computers:

emerge sync
emerge -pv ">=dev-db/mysql-4.0.21"
emerge ">=dev-db/mysql-4.0.21"

RedHat has released advisory RHSA-2004:611-04 along with fixes to address various issues in MySQL for RedHat Enterprise Linux operating systems. Please see the referenced advisory for further information.

OpenPKG has released advisory OpenPKG-SA-2004.045 to address various issues in MySQL. Please see the referenced advisory for further information.

Mandrake Linux has released advisory MDKSA-2004:119 along with fixes dealing with this and other issues. Please see the referenced advisory for more information.

SuSE has released a security summary report (SUSE-SR:2004:001) to address this and other issues. The report indicates that a fix for this issue is available on the SuSE FTP server and also through the YaST Online Update utility. Customers are advised to peruse the referenced advisory for further details regarding obtaining and applying appropriate fixes.

Ubuntu Linux has released advisory USN-32-1 along with fixes to address this, and other issues. Please see the referenced advisory for further information.

RedHat Fedora has made an advisory available (FEDORA-2004-530) dealing with this and other issues. Please see the referenced advisory for more information.

TurboLinux has released Security Announcement 17/Feb/2005 dealing with this and other issues; please see the reference section for more information.

A Fedora Legacy advisory FLSA:2129 is available to address this issue in Red Hat Linux 7.3, Red Hat Linux 9, and Fedora Core 1 for the i386 architecture. Please see the referenced advisory for more information.


MySQL AB MySQL 3.23.49

MySQL AB MySQL 3.23.52

MySQL AB MySQL 3.23.54 a

MySQL AB MySQL 3.23.56

MySQL AB MySQL 3.23.58

MySQL AB MySQL 4.0.18

MySQL AB MySQL 4.0.20

References

MySQL Mysql_real_connect Function Potential Remote Buffer Overflow Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report