MySQL 5.0.51a Unspecified Remote Code Execution Vulnerability
BID:37640
Info
MySQL 5.0.51a Unspecified Remote Code Execution Vulnerability
| Bugtraq ID: | 37640 |
| Class: | Unknown |
| CVE: |
CVE-2009-4484 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 06 2010 12:00AM |
| Updated: | Mar 12 2012 05:00PM |
| Credit: | <br>Intervydis |
| Vulnerable: |
Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise 10 SP3 SuSE SUSE Linux Enterprise 10 SP2 MySQL AB MySQL 5.0.51a Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 |
| Not Vulnerable: | |
Discussion
MySQL 5.0.51a Unspecified Remote Code Execution Vulnerability
MySQL 5.0.51a is prone to an unspecified remote code-execution vulnerability.
Very few technical details are currently available. We will update this BID as more information emerges.
An attacker can leverage this issue to execute arbitrary code within the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.
This issue affects MySQL 5.0.51a; other versions may also be vulnerable.
MySQL 5.0.51a is prone to an unspecified remote code-execution vulnerability.
Very few technical details are currently available. We will update this BID as more information emerges.
An attacker can leverage this issue to execute arbitrary code within the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.
This issue affects MySQL 5.0.51a; other versions may also be vulnerable.
Exploit / POC
MySQL 5.0.51a Unspecified Remote Code Execution Vulnerability
A working exploit has been developed by Intevydis. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working exploit has been developed by Intevydis. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
MySQL 5.0.51a Unspecified Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 9.10 sparc
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 9.10 sparc
-
Ubuntu libmysqlclient16_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/libmysqlclient16_5. 1.37-1ubuntu5.1_sparc.deb -
Ubuntu libmysqld-dev_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/libmysqld-dev_5.1.3 7-1ubuntu5.1_sparc.deb -
Ubuntu libmysqld-pic_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/libmysqld-pic_5.1.3 7-1ubuntu5.1_sparc.deb -
Ubuntu mysql-client-5.1_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/mysql-client-5.1_5. 1.37-1ubuntu5.1_sparc.deb -
Ubuntu mysql-server-5.1_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/mysql-server-5.1_5. 1.37-1ubuntu5.1_sparc.deb -
Ubuntu mysql-server-core-5.1_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/mysql-server-core-5 .1_5.1.37-1ubuntu5.1_sparc.deb
References
MySQL 5.0.51a Unspecified Remote Code Execution Vulnerability
References:
References:
- 0day demos (Evgeny Legerov)
- MySQL Homepage (Oracle)
- MySQL remote exploit demo (Intevydis)
- Ubuntu Security Notice USN-897-1 (Ubuntu)