PT-2008-5293 · Oracle+1 · Mysql Server+1

Alexey Vlasov · Published 2008-09-10 · Updated 2019-12-17 · CVE-2008-3963

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions 5.0 before 5.0.66 MySQL versions 5.1 before 5.1.26 MySQL versions 6.0 before 6.0.6

Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash. This is achieved by using a specific token, an empty bit-string literal, in a SQL statement.

Recommendations For MySQL versions 5.0 before 5.0.66, update to version 5.0.66 or later. For MySQL versions 5.1 before 5.1.26, update to version 5.1.26 or later. For MySQL versions 6.0 before 6.0.6, update to version 6.0.6 or later.

Exploit

Fix

DoS

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2008-3963

DSA-1783-1

RHSA-2009:1067

RHSA-2009:1289

RHSA-2009_1289

Affected Products

Mysql Server

Red Hat

References · 34

• 🔥 https://exploit-db.com/exploits/32348 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3963 · Security Note
• http://secunia.com/advisories/32759 · Vendor Advisory
• http://ubuntu.com/usn/USN-1397-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-671-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:094 · Vendor Advisory
• http://secunia.com/advisories/31769 · Vendor Advisory
• http://secunia.com/advisories/34907 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1067.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1289.html · Vendor Advisory
• http://vupen.com/english/advisories/2008/2554 · Vendor Advisory
• http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0058.html · Note
• http://securitytracker.com/id?1020858 · Note