PT-2005-3449 · Oracle · Mysql Server

Reid Borsuk · Published 2005-08-16 · Updated 2019-12-17 · CVE-2005-2558

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions 4.0 through 4.0.24 MySQL versions 4.1 through 4.1.12 MySQL versions 5.0 through 5.0.6-beta

Description A stack-based buffer overflow issue exists in the init syms function, allowing remote authenticated users who can create user-defined functions to execute arbitrary code via a long function name field.

Recommendations For MySQL versions 4.0 through 4.0.24, update to version 4.0.25 or later. For MySQL versions 4.1 through 4.1.12, update to version 4.1.13 or later. For MySQL versions 5.0 through 5.0.6-beta, update to version 5.0.7-beta or later.

Fix

Related Identifiers

CVE-2005-2558

DSA-829-1

DSA-831-1

DSA-833-2

Affected Products

Mysql Server

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2005-2558 · Security Note
• http://debian.org/security/2005/dsa-829 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:163 · Vendor Advisory
• http://debian.org/security/2005/dsa-833 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_21_sr.html · Vendor Advisory
• https://ubuntu.com/usn/usn-180-2 · Vendor Advisory
• http://redhat.com/archives/fedora-legacy-announce/2006-January/msg00005.html · Vendor Advisory
• http://appsecinc.com/resources/alerts/mysql/2005-002.html · Vendor Advisory
• ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.18.1/SCOSA-2006.18.1.txt · Vendor Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2005-August/035845.html · Vendor Advisory
• http://securityfocus.com/bid/14509 · Patch
• https://ubuntu.com/usn/usn-180-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-236703-1 · Vendor Advisory
• http://debian.org/security/2005/dsa-831 · Vendor Advisory
• http://secunia.com/advisories/29847 · Note