PT-2006-4344 · Mysql Server+1 · Mysql Server+1

Jean-David Maillefer · Published 2006-07-18 · Updated 2019-12-17 · CVE-2006-3469

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MySQL Server versions 4.1 before 4.1.21 MySQL Server versions 5.0 before 5.0.21

Description A format string issue in the time.cc component allows remote authenticated users to cause a denial of service by providing a format string instead of a date as the first parameter to the date format function. This input is later used in a formatted print call to display an error message, leading to a potential crash.

Recommendations For MySQL Server versions 4.1 before 4.1.21, update to version 4.1.21 or later. For MySQL Server versions 5.0 before 5.0.21, update to version 5.0.21 or later.

Exploit

Fix

DoS

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2006-3469

DSA-1112

RHSA-2008:0768

RHSA-2008_0768

Affected Products

Mysql Server

Red Hat

References · 26

• 🔥 https://exploit-db.com/exploits/28234 · Exploit
• http://secunia.com/advisories/21366 · Vendor Advisory
• http://vupen.com/english/advisories/2007/0930 · Vendor Advisory
• http://secunia.com/advisories/31226 · Vendor Advisory
• http://secunia.com/advisories/24479 · Vendor Advisory
• http://debian.org/security/2006/dsa-1112 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html · Vendor Advisory
• http://secunia.com/advisories/21147 · Vendor Advisory
• http://ubuntu.com/usn/usn-321-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0768.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200608-09.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3469 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=375694 · Note
• https://access.redhat.com/errata/RHSA-2008:0768 · Note
• https://access.redhat.com/security/cve/CVE-2008-2079 · Note