PT-2006-3673 · Oracle+1 · Mysql Server+1

Josh Berkus + 1 · Published 2006-06-01 · Updated 2019-12-17 · CVE-2006-2753

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions 4.1.x through 4.1.19 MySQL versions 5.0.x through 5.0.21

Description A SQL injection issue allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK. The issue arises because these character sets are not properly handled when the mysql real escape function is used to escape the input.

Recommendations For MySQL versions 4.1.x through 4.1.19, update to version 4.1.20 or later. For MySQL versions 5.0.x through 5.0.21, update to version 5.0.22 or later.

Fix

Related Identifiers

CVE-2006-2753

DSA-1092-1

RHSA-2006:0544

RHSA-2006_0544

Affected Products

Mysql Server

Red Hat

References · 36

• http://debian.org/security/2006/dsa-1092 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:097 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0544.html · Vendor Advisory
• https://usn.ubuntu.com/303-1 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html · Vendor Advisory
• http://trustix.org/errata/2006/0034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2753 · Security Note
• http://lists.mysql.com/announce/364 · Patch
• http://gentoo.org/security/en/glsa/glsa-200606-13.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-288-3 · Vendor Advisory
• http://securityfocus.com/bid/18439 · Note
• https://access.redhat.com/security/cve/CVE-2006-2753 · Note
• http://vupen.com/english/advisories/2006/2105 · Note
• http://bugs.mysql.com/10442 · Note
• https://access.redhat.com/security/cve/CVE-2006-1517 · Note