MySQL Password Handler Buffer Overflow Vulnerability
BID:8590
Info
MySQL Password Handler Buffer Overflow Vulnerability
| Bugtraq ID: | 8590 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2003-0780 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 10 2003 12:00AM |
| Updated: | Jul 11 2009 11:56PM |
| Credit: | Discovery of this vulnerability has been credited to Frank Denis <[email protected]>. |
| Vulnerable: |
SGI ProPack 2.3 SGI ProPack 2.2.1 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 2.1 Redhat Advanced Workstation for the Itanium Processor 2.1 MySQL AB MySQL 4.0.14 MySQL AB MySQL 4.0.13 MySQL AB MySQL 4.0.12 MySQL AB MySQL 4.0.11 -gamma MySQL AB MySQL 4.0.11 MySQL AB MySQL 4.0.10 MySQL AB MySQL 4.0.9 -gamma MySQL AB MySQL 4.0.9 MySQL AB MySQL 4.0.8 -gamma MySQL AB MySQL 4.0.8 MySQL AB MySQL 4.0.7 -gamma MySQL AB MySQL 4.0.7 MySQL AB MySQL 4.0.6 MySQL AB MySQL 4.0.5 a MySQL AB MySQL 4.0.5 MySQL AB MySQL 4.0.4 MySQL AB MySQL 4.0.3 MySQL AB MySQL 4.0.2 MySQL AB MySQL 4.0.1 MySQL AB MySQL 4.0 .0 MySQL AB MySQL 3.23.58 MySQL AB MySQL 3.23.56 MySQL AB MySQL 3.23.55 MySQL AB MySQL 3.23.54 a MySQL AB MySQL 3.23.54 MySQL AB MySQL 3.23.53 a MySQL AB MySQL 3.23.53 MySQL AB MySQL 3.23.52 MySQL AB MySQL 3.23.51 MySQL AB MySQL 3.23.50 MySQL AB MySQL 3.23.49 MySQL AB MySQL 3.23.48 MySQL AB MySQL 3.23.47 MySQL AB MySQL 3.23.46 MySQL AB MySQL 3.23.45 MySQL AB MySQL 3.23.44 MySQL AB MySQL 3.23.43 MySQL AB MySQL 3.23.42 MySQL AB MySQL 3.23.41 MySQL AB MySQL 3.23.40 MySQL AB MySQL 3.23.39 MySQL AB MySQL 3.23.38 MySQL AB MySQL 3.23.37 MySQL AB MySQL 3.23.36 MySQL AB MySQL 3.23.34 MySQL AB MySQL 3.23.33 MySQL AB MySQL 3.23.32 MySQL AB MySQL 3.23.31 MySQL AB MySQL 3.23.30 MySQL AB MySQL 3.23.29 MySQL AB MySQL 3.23.28 gamma MySQL AB MySQL 3.23.28 MySQL AB MySQL 3.23.27 MySQL AB MySQL 3.23.26 MySQL AB MySQL 3.23.25 MySQL AB MySQL 3.23.24 MySQL AB MySQL 3.23.23 MySQL AB MySQL 3.23.22 MySQL AB MySQL 3.23.10 MySQL AB MySQL 3.23.9 MySQL AB MySQL 3.23.8 MySQL AB MySQL 3.23.5 MySQL AB MySQL 3.23.4 MySQL AB MySQL 3.23.3 MySQL AB MySQL 3.23.2 MySQL AB MySQL 3.23 .x MySQL AB MySQL 4.1.0.0-alpha MySQL AB MySQL 4.1.0-0 |
| Not Vulnerable: |
MySQL AB MySQL 4.0.15 |
Discussion
MySQL Password Handler Buffer Overflow Vulnerability
MySQL server has been reported prone to a buffer overflow vulnerability when handling user passwords of excessive size.
The issue presents itself, due to a lack of sufficient bounds checking performed when processing MySQL user passwords. A password greater that 16 characters may overrun the bounds of a reserved buffer in memory and corrupt adjacent memory. An attacker with global administrative privileges on an affected MySQL server may potentially exploit this condition to have arbitrary supplied instructions executed in the context of the MySQL server.
MySQL server has been reported prone to a buffer overflow vulnerability when handling user passwords of excessive size.
The issue presents itself, due to a lack of sufficient bounds checking performed when processing MySQL user passwords. A password greater that 16 characters may overrun the bounds of a reserved buffer in memory and corrupt adjacent memory. An attacker with global administrative privileges on an affected MySQL server may potentially exploit this condition to have arbitrary supplied instructions executed in the context of the MySQL server.
References
MySQL Password Handler Buffer Overflow Vulnerability
References:
References:
- CLSA-2003:764 MySQL (Conectiva)
- MySQL Homepage (Oracle)
- MySQL password handler exploit (CORE Security)
- RHSA-2003-282 (Red Hat)
- Sun Cobalt Qube 3 Patches (Sun)
- Sun Cobalt RaQ550 Patches (Sun)
- Sun Linux Support - Sun Linux Patches (Sun)
- Buffer overflow in MySQL (Jedi/Sector One