BID:13368

MySQL MaxDB HTTP GET Request Remote Buffer Overflow Vulnerability

Info

MySQL MaxDB HTTP GET Request Remote Buffer Overflow Vulnerability

Bugtraq ID:	13368
Class:	Boundary Condition Error
CVE:	CVE-2005-0684
Remote:	Yes
Local:	No
Published:	Apr 26 2005 12:00AM
Updated:	Nov 15 2007 12:40AM
Credit:	The discoverer of this vulnerability wishes to remain anonymous.
Vulnerable:	MySQL AB MaxDB 7.5 .00.25 MySQL AB MaxDB 7.5 .00.24 MySQL AB MaxDB 7.5 .00.23 MySQL AB MaxDB 7.5 .00.19 MySQL AB MaxDB 7.5 .00.18 MySQL AB MaxDB 7.5 .00.16 MySQL AB MaxDB 7.5 .00.15 MySQL AB MaxDB 7.5 .00.14 MySQL AB MaxDB 7.5 .00.12 MySQL AB MaxDB 7.5 .00.11 MySQL AB MaxDB 7.5 .00.08 MySQL AB MaxDB 7.5 .00

Not Vulnerable:	MySQL AB MaxDB 7.5 .00.26

Discussion

MySQL MaxDB HTTP GET Request Remote Buffer Overflow Vulnerability

A remote buffer-overflow vulnerability affects MySQL MaxDB because the application fails to properly validate the length of user-supplied strings before copying them into static process buffers.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

Exploit / POC

MySQL MaxDB HTTP GET Request Remote Buffer Overflow Vulnerability

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

An exploit has been made available for the Metasploit framework. An additional exploit (20050427.sql_expl.c) was also released by cybertronic.

/data/vulnerabilities/exploits/maxdb_webdbm_get_overflow.pm
/data/vulnerabilities/exploits/20050427.sql_expl.c

Solution / Fix

MySQL MaxDB HTTP GET Request Remote Buffer Overflow Vulnerability

Solution:
The vendor has released an upgrade to address this issue.

MySQL AB MaxDB 7.5 .00.18