PT-2005-1192 · Mysql Server · Mysql Maxdb

Publicado 2005-03-17 · Atualizado 2017-07-11 · CVE-2005-0083

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MySQL MaxDB versions prior to 7.5.00

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash, by providing invalid parameters to certain functions. These functions include DBMCli String::ReallocString, DBMCli String::operator, DBMCli Buffer::ForceResize, DBMCli Wizard::InstallDatabase, DBMCli Devspaces::Complete, DBMWeb TemplateWizard::askForWriteCountStep5, and DBMWeb DBMWeb::wizardDB. The crash is triggered by a null dereference.

Recommendations For versions prior to 7.5.00, as a temporary workaround, consider disabling the affected functions until a patch is available. Restrict access to the DBMCli String, DBMCli Buffer, DBMCli Wizard, DBMCli Devspaces, DBMWeb TemplateWizard, and DBMWeb DBMWeb modules to minimize the risk of exploitation. Avoid using invalid parameters in the affected functions to prevent the application crash. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2005-0083

Produtos afetados

Mysql Maxdb

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-0083 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19687 · Nota
• http://idefense.com/application/poi/display?id=218&type=vulnerabilities · Aviso do Fabricante