ISS X-Force Database: mysql-mysqlrealconnect-bo(12337): MySQL mysql_real

MySQL mysql_real_connect function buffer overflow

mysql-mysqlrealconnect-bo (12337)

High Risk

Description:

MySQL is vulnerable to a buffer overflow in the libmysql MySQL client library, caused by a vulnerability in the mysql_real_connect function. A remote or local attacker could pass an overly long argument to the mysql_real_connect function, to overflow a buffer and cause the system to crash, or possibly execute arbitrary code on the system.

Platforms Affected:

MySQL, MySQL 3.20
MySQL, MySQL 3.20.32a
MySQL, MySQL 3.21
MySQL, MySQL 3.22
MySQL, MySQL 3.22.26
MySQL, MySQL 3.22.27
MySQL, MySQL 3.22.28
MySQL, MySQL 3.22.29
MySQL, MySQL 3.22.30
MySQL, MySQL 3.22.32
MySQL, MySQL 3.23
MySQL, MySQL 3.23.0 Alpha
MySQL, MySQL 3.23.1
MySQL, MySQL 3.23.10
MySQL, MySQL 3.23.11
MySQL, MySQL 3.23.12
MySQL, MySQL 3.23.13
MySQL, MySQL 3.23.14
MySQL, MySQL 3.23.15
MySQL, MySQL 3.23.16
MySQL, MySQL 3.23.17
MySQL, MySQL 3.23.18
MySQL, MySQL 3.23.19
MySQL, MySQL 3.23.2
MySQL, MySQL 3.23.20
MySQL, MySQL 3.23.20 Beta
MySQL, MySQL 3.23.21
MySQL, MySQL 3.23.22
MySQL, MySQL 3.23.23
MySQL, MySQL 3.23.24
MySQL, MySQL 3.23.25
MySQL, MySQL 3.23.26
MySQL, MySQL 3.23.27
MySQL, MySQL 3.23.28
MySQL, MySQL 3.23.28 Gamma
MySQL, MySQL 3.23.29
MySQL, MySQL 3.23.3
MySQL, MySQL 3.23.30
MySQL, MySQL 3.23.31
MySQL, MySQL 3.23.32
MySQL, MySQL 3.23.33
MySQL, MySQL 3.23.34
MySQL, MySQL 3.23.35
MySQL, MySQL 3.23.36
MySQL, MySQL 3.23.37
MySQL, MySQL 3.23.38
MySQL, MySQL 3.23.39
MySQL, MySQL 3.23.4
MySQL, MySQL 3.23.40
MySQL, MySQL 3.23.41
MySQL, MySQL 3.23.42
MySQL, MySQL 3.23.43
MySQL, MySQL 3.23.44
MySQL, MySQL 3.23.45
MySQL, MySQL 3.23.46
MySQL, MySQL 3.23.47
MySQL, MySQL 3.23.48
MySQL, MySQL 3.23.49
MySQL, MySQL 3.23.5
MySQL, MySQL 3.23.50
MySQL, MySQL 3.23.51
MySQL, MySQL 3.23.52
MySQL, MySQL 3.23.53
MySQL, MySQL 3.23.53a
MySQL, MySQL 3.23.54
MySQL, MySQL 3.23.54a
MySQL, MySQL 3.23.55
MySQL, MySQL 3.23.56
MySQL, MySQL 3.23.57
MySQL, MySQL 3.23.58
MySQL, MySQL 3.23.59
MySQL, MySQL 3.23.6
MySQL, MySQL 3.23.7
MySQL, MySQL 3.23.8
MySQL, MySQL 3.23.9
MySQL, MySQL 4.0.0
MySQL, MySQL 4.0.1
MySQL, MySQL 4.0.10
MySQL, MySQL 4.0.11
MySQL, MySQL 4.0.11 Gamma
MySQL, MySQL 4.0.12
MySQL, MySQL 4.0.13
MySQL, MySQL 4.0.14
MySQL, MySQL 4.0.15
MySQL, MySQL 4.0.16
MySQL, MySQL 4.0.17
MySQL, MySQL 4.0.18
MySQL, MySQL 4.0.19
MySQL, MySQL 4.0.2
MySQL, MySQL 4.0.20
MySQL, MySQL 4.0.21
MySQL, MySQL 4.0.23
MySQL, MySQL 4.0.24
MySQL, MySQL 4.0.25
MySQL, MySQL 4.0.26
MySQL, MySQL 4.0.27
MySQL, MySQL 4.0.3
MySQL, MySQL 4.0.4
MySQL, MySQL 4.0.5
MySQL, MySQL 4.0.5A
MySQL, MySQL 4.0.6
MySQL, MySQL 4.0.7 Gamma
MySQL, MySQL 4.0.7
MySQL, MySQL 4.0.8 Gamma
MySQL, MySQL 4.0.8
MySQL, MySQL 4.0.9 Gamma
MySQL, MySQL 4.0.9
MySQL, MySQL 4.1
MySQL, MySQL 4.1.0
MySQL, MySQL 4.1.0 Alpha
MySQL, MySQL 4.1.0.0
MySQL, MySQL 4.1.0.0 Alpha
MySQL, MySQL 4.1.1
MySQL, MySQL 4.1.10
MySQL, MySQL 4.1.10a
MySQL, MySQL 4.1.11
MySQL, MySQL 4.1.11a
MySQL, MySQL 4.1.12
MySQL, MySQL 4.1.12a
MySQL, MySQL 4.1.13
MySQL, MySQL 4.1.13a
MySQL, MySQL 4.1.14
MySQL, MySQL 4.1.14a
MySQL, MySQL 4.1.15
MySQL, MySQL 4.1.15a
MySQL, MySQL 4.1.16
MySQL, MySQL 4.1.17
MySQL, MySQL 4.1.18
MySQL, MySQL 4.1.19
MySQL, MySQL 4.1.2
MySQL, MySQL 4.1.2 Alpha
MySQL, MySQL 4.1.20
MySQL, MySQL 4.1.21
MySQL, MySQL 4.1.22
MySQL, MySQL 4.1.3
MySQL, MySQL 4.1.3 Beta
MySQL, MySQL 4.1.3.0
MySQL, MySQL 4.1.4
MySQL, MySQL 4.1.5
MySQL, MySQL 4.1.6
MySQL, MySQL 4.1.7
MySQL, MySQL 4.1.8
MySQL, MySQL 4.1.8a
MySQL, MySQL 4.1.9

Remedy:

No remedy available as of July 4, 2009.

Consequences:

Gain Access

References:

BID-7887: MySQL libmysqlclient Library mysql_real_connect() Buffer Overrun Vulnerability
CVE-2003-1331: Stack-based buffer overflow in the mysql_real_connect function in the MySql client library (libmysqlclient) 4.0.13 and earlier allows local users to execute arbitrary code via a long socket name, a different vulnerability than CVE-2001-1453.

Reported:

Jun 12, 2003

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page