PT-2006-3673 · Oracle+1 · Mysql Server+1

Josh Berkus + 1 · Publicado 2006-06-01 · Atualizado 2019-12-17 · CVE-2006-2753

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions 4.1.x through 4.1.19 MySQL versions 5.0.x through 5.0.21

Description A SQL injection issue allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK. The issue arises because these character sets are not properly handled when the mysql real escape function is used to escape the input.

Recommendations For MySQL versions 4.1.x through 4.1.19, update to version 4.1.20 or later. For MySQL versions 5.0.x through 5.0.21, update to version 5.0.22 or later.

Correção

Identificadores relacionados

CVE-2006-2753

DSA-1092-1

RHSA-2006:0544

RHSA-2006_0544

Produtos afetados

Mysql Server

Red Hat

Referências · 36

• http://securityfocus.com/bid/18439 · Nota
• https://access.redhat.com/security/cve/CVE-2006-2753 · Nota
• http://debian.org/security/2006/dsa-1092 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDKSA-2006:097 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/2105 · Nota
• http://redhat.com/support/errata/RHSA-2006-0544.html · Aviso do Fabricante
• http://bugs.mysql.com/10442 · Nota
• https://access.redhat.com/security/cve/CVE-2006-1517 · Nota
• http://secunia.com/advisories/20365 · Nota
• https://access.redhat.com/errata/RHSA-2006:0544 · Nota
• http://secunia.com/advisories/20562 · Nota
• http://us-cert.gov/cas/techalerts/TA07-072A.html · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=369735 · Nota
• http://secunia.com/advisories/20489 · Nota
• https://usn.ubuntu.com/303-1 · Aviso do Fabricante