PT-2008-5293 · Oracle+1 · Mysql Server+1

Alexey Vlasov · Publicado 2008-09-10 · Atualizado 2019-12-17 · CVE-2008-3963

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions 5.0 before 5.0.66 MySQL versions 5.1 before 5.1.26 MySQL versions 6.0 before 6.0.6

Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash. This is achieved by using a specific token, an empty bit-string literal, in a SQL statement.

Recommendations For MySQL versions 5.0 before 5.0.66, update to version 5.0.66 or later. For MySQL versions 5.1 before 5.1.26, update to version 5.1.26 or later. For MySQL versions 6.0 before 6.0.6, update to version 6.0.6 or later.

Exploit

Correção

DoS

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2008-3963

DSA-1783-1

RHSA-2009:1067

RHSA-2009:1289

RHSA-2009_1289

Produtos afetados

Mysql Server

Red Hat

Referências · 34

• 🔥 https://exploit-db.com/exploits/32348 · Exploit
• http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3963 · Nota de Segurança
• http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0058.html · Nota
• http://secunia.com/advisories/32759 · Aviso do Fabricante
• http://securitytracker.com/id?1020858 · Nota
• http://ubuntu.com/usn/USN-1397-1 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2008-2079 · Nota
• http://bugs.mysql.com/bug.php?id=35658 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45042 · Nota
• http://openwall.com/lists/oss-security/2008/09/09/4 · Nota
• https://access.redhat.com/security/cve/CVE-2009-2446 · Nota
• https://bugs.gentoo.org/237166 · Nota
• http://ubuntu.com/usn/USN-671-1 · Aviso do Fabricante
• http://securityfocus.com/bid/35609 · Nota