CVE-2004-0836 Buffer overflow in the mysql_real_connect function in MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows remote DNS servers to cause a denial of service and possibly execute arbitrary code via a....
HighCVSS 10.0
EPSS 9.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the mysql_real_connect function in MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows remote DNS servers to cause a denial of service and possibly execute arbitrary code via a DNS response with a large address length (h_length).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle MySQL | >= 3.20, < 3.23.49 | 3.23.49 |
| oracle MySQL | >= 4.0.0, < 4.0.21 | 4.0.21 |
| debian linux | = 3.0 | No fix listed |
References
- bugs.mysql.com exploit vendor-advisory
- CLA-2004:892 broken-link vendor-advisory
- lists.mysql.com vendor-advisory
- 20041125 [USN-32-1] mysql vulnerabilities mailing-list third-party-advisory
- 12305 third-party-advisory
- P-018 broken-link government-resource third-party-advisory
- DSA-562 third-party-advisory vendor-advisory
- GLSA-200410-22 third-party-advisory vendor-advisory
- RHSA-2004:597 patch vendor-advisory
- RHSA-2004:611 patch vendor-advisory
- 10981 third-party-advisory vdb-entry
- 2004-0054 vendor-advisory
- mysql-realconnect-bo(17047) third-party-advisory vdb-entry