CVE-2003-0780 Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.
HighCVSS 9.0
EPSS 78.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mysql | = 4.1.0 | No fix listed |
| oracle MySQL | = 3.23 | No fix listed |
| oracle MySQL | = 3.23.2 | No fix listed |
| oracle MySQL | = 3.23.3 | No fix listed |
| oracle MySQL | = 3.23.4 | No fix listed |
| oracle MySQL | = 3.23.5 | No fix listed |
| oracle MySQL | = 3.23.8 | No fix listed |
| oracle MySQL | = 3.23.9 | No fix listed |
| oracle MySQL | = 3.23.10 | No fix listed |
| oracle MySQL | = 3.23.22 | No fix listed |
| oracle MySQL | = 3.23.23 | No fix listed |
| oracle MySQL | = 3.23.24 | No fix listed |
| oracle MySQL | = 3.23.25 | No fix listed |
| oracle MySQL | = 3.23.26 | No fix listed |
| oracle MySQL | = 3.23.27 | No fix listed |
| oracle MySQL | = 3.23.28 | No fix listed |
| oracle MySQL | = 3.23.28-gamma | No fix listed |
| oracle MySQL | = 3.23.29 | No fix listed |
| oracle MySQL | = 3.23.30 | No fix listed |
| oracle MySQL | = 3.23.31 | No fix listed |
| oracle MySQL | = 3.23.32 | No fix listed |
| oracle MySQL | = 3.23.33 | No fix listed |
| oracle MySQL | = 3.23.34 | No fix listed |
| oracle MySQL | = 3.23.36 | No fix listed |
| oracle MySQL | = 3.23.37 | No fix listed |
Show 45 more
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle MySQL | = 3.23.38 | No fix listed |
| oracle MySQL | = 3.23.39 | No fix listed |
| oracle MySQL | = 3.23.40 | No fix listed |
| oracle MySQL | = 3.23.41 | No fix listed |
| oracle MySQL | = 3.23.42 | No fix listed |
| oracle MySQL | = 3.23.43 | No fix listed |
| oracle MySQL | = 3.23.44 | No fix listed |
| oracle MySQL | = 3.23.45 | No fix listed |
| oracle MySQL | = 3.23.46 | No fix listed |
| oracle MySQL | = 3.23.47 | No fix listed |
| oracle MySQL | = 3.23.48 | No fix listed |
| oracle MySQL | = 3.23.49 | No fix listed |
| oracle MySQL | = 3.23.50 | No fix listed |
| oracle MySQL | = 3.23.51 | No fix listed |
| oracle MySQL | = 3.23.52 | No fix listed |
| oracle MySQL | = 3.23.53 | No fix listed |
| oracle MySQL | = 3.23.53a | No fix listed |
| oracle MySQL | = 3.23.54 | No fix listed |
| oracle MySQL | = 3.23.54a | No fix listed |
| oracle MySQL | = 3.23.55 | No fix listed |
| oracle MySQL | = 3.23.56 | No fix listed |
| oracle MySQL | = 4.0.0 | No fix listed |
| oracle MySQL | = 4.0.1 | No fix listed |
| oracle MySQL | = 4.0.2 | No fix listed |
| oracle MySQL | = 4.0.3 | No fix listed |
| oracle MySQL | = 4.0.4 | No fix listed |
| oracle MySQL | = 4.0.5 | No fix listed |
| oracle MySQL | = 4.0.5a | No fix listed |
| oracle MySQL | = 4.0.6 | No fix listed |
| oracle MySQL | = 4.0.7 | No fix listed |
| oracle MySQL | = 4.0.7-gamma | No fix listed |
| oracle MySQL | = 4.0.8 | No fix listed |
| oracle MySQL | = 4.0.8-gamma | No fix listed |
| oracle MySQL | = 4.0.9 | No fix listed |
| oracle MySQL | = 4.0.9-gamma | No fix listed |
| oracle MySQL | = 4.0.10 | No fix listed |
| oracle MySQL | = 4.0.11 | No fix listed |
| oracle MySQL | = 4.0.11-gamma | No fix listed |
| oracle MySQL | = 4.0.12 | No fix listed |
| oracle MySQL | = 4.0.13 | No fix listed |
| oracle MySQL | = 4.0.14 | No fix listed |
| oracle MySQL | = 4.1.0-alpha | No fix listed |
| conectiva linux | = 7.0 | No fix listed |
| conectiva linux | = 8.0 | No fix listed |
| conectiva linux | = 9.0 | No fix listed |
References
- CLA-2003:743 vendor-advisory
- 20030910 Buffer overflow in MySQL mailing-list
- 20030913 exploit for mysql -- [get_salt_from_password] problem mailing-list
- 2003-0034 vendor-advisory
- 9709 third-party-advisory
- DSA-381 patch vendor-advisory
- VU#516492 third-party-advisory us-government-resource
- MDKSA-2003:094 vendor-advisory
- RHSA-2003:281 patch vendor-advisory
- RHSA-2003:282 vendor-advisory
- 20030910 Buffer overflow in MySQL exploit mailing-list patch vendor-advisory