Secunia reports :

MySQL have some vulnerabilities, which can be exploited by malicious users to disclose potentially sensitive information and compromise a vulnerable system.

1) An error within the code that generates an error response to an invalid COM_TABLE_DUMP packet can be exploited by an authenticated client to disclosure certain memory content of the server process.

2) A boundary error within the handling of specially crafted invalid COM_TABLE_DUMP packets can be exploited by an authenticated client to cause a buffer overflow and allows arbitrary code execution.

3) An error within the handling of malformed login packets can be exploited to disclosure certain memory content of the server process in the error messages.

リモートホストにインストールされている MySQL のバージョンは、4.0.27 / 4.1.19 / 5.0.21より前です。このため、以下の脆弱性の影響を受ける可能性があります。

  - リモートの攻撃者が、ユーザー名の末端にNULLがない特別に細工されたログインパケットを送信することで、メモリの部分を読み込む可能性があります。（CVE-2006-1516）

  - リモートの攻撃者が、不適切なパケットの長さの特別に細工されたCOM_TABLE_DUMPリクエストを送信することで、メモリの部分を読み込む可能性があります。（CVE-2006-1517）

  - 「open_table()」関数のバッファオーバーフローにより、認証されたリモートの攻撃者が、特別に細工されたCOM_TABLE_DUMPパケットを介して、任意のコードを実行する可能性があります。（CVE-2006-1518）

遠端主機上安裝的 MySQL 版本比 4.0.27 / 4.1.19 / 5.0.21 舊。因此可能會受到以下弱點影響：

- 遠端攻擊者可能傳送特製的登入封包，其中使用者名稱不具有結尾 NULL，進而讀取部分記憶體。(CVE-2006-1516)

- 遠端攻擊者可能傳送具有不正確封包長度的特製 COM_TABLE_DUMP 要求，進而讀取部分記憶體。(CVE-2006-1517)

-「open_table()」函式中有一個緩衝區溢位問題，其可允許未經驗證的遠端攻擊者透過特製的 COM_TABLE_DUMP 封包執行任意程式碼。(CVE-2006-1518)

远程主机上安装的 MySQL 版本低于 4.0.27 / 4.1.19 / 5.0.21。因此，它可能会受到以下漏洞的影响：

- 远程攻击者可能发送特别构建的登录数据包，其中用户名不具有尾随的 NULL，进而读取部分内存。(CVE-2006-1516)

- 远程攻击者可能发送具有不正确数据包长度的特别构建的 COM_TABLE_DUMP 请求，进而读取部分内存。(CVE-2006-1517)

-“open_table()”函数中有一个缓冲区溢出，其可允许未经认证的远程攻击者通过特别构建的 COM_TABLE_DUMP 数据包执行任意代码。(CVE-2006-1518)

Several vulnerabilities have been discovered in MySQL, a popular SQL database. The Common Vulnerabilities and Exposures Project identifies the following problems :

  - CVE-2006-0903     Improper handling of SQL queries containing the NULL     character allows local users to bypass logging     mechanisms.

  - CVE-2006-1516     Usernames without a trailing null byte allow remote     attackers to read portions of memory.

  - CVE-2006-1517     A request with an incorrect packet length allows remote     attackers to obtain sensitive information.

  - CVE-2006-1518     Specially crafted request packets with invalid length     values allow the execution of arbitrary code.

The following vulnerability matrix shows which version of MySQL in which distribution has this problem fixed :

                   woody            sarge            sid                mysql            3.23.49-8.15     n/a              n/a                mysql-dfsg       n/a              4.0.24-10sarge2  n/a                mysql-dfsg-4.1   n/a              4.1.11a-4sarge3  n/a                mysql-dfsg-5.0   n/a              n/a              5.0.21-3

The version of MySQL installed on the remote host is earlier than 4.0.27 / 4.1.19 / 5.0.21.  As such, it is potentially affected by the following vulnerabilities :

  - A remote attacker may be able to read portions of memory     by sending a specially crafted login packet in which the     username does not have a trailing NULL. (CVE-2006-1516)

  - A remote attacker may be able to read portions of memory     by sending a specially crafted COM_TABLE_DUMP request     with an incorrect packet length. (CVE-2006-1517)

  - A buffer overflow in the 'open_table()' function could     allow a remote, authenticated attacker to execute     arbitrary code via specially crafted COM_TABLE_DUMP     packets. (CVE-2006-1518)

New mysql packages are available for Slackware 10.2 and -current to fix security issues. The MySQL package shipped with Slackware 10.2 may possibly leak sensitive information found in uninitialized memory to authenticated users. The MySQL package previously in Slackware
-current also suffered from these flaws, but an additional overflow could allow arbitrary code execution. Since the vulnerabilities require a valid login and/or access to the database server, the risk is moderate. Slackware does not provide network access to a MySQL database by default.

Stefano Di Paola reports :

An authenticated user could remotely execute arbitrary commands by taking advantage of a stack overflow.

To take advantage of these flaws an attacker should have direct access to MySQL server communication layer (port 3306 or unix socket). But if used in conjuction with some web application flaws (i.e. php code injection) an attacker could use socket programming (i.e. php sockets) to gain access to that layer.

MySQL did not correctly handle NULL as the second argument to the str_to_date() function. An authenticated user could exploit this to crash the server.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Attackers could read portions of memory by using a user name with trailing null byte or via COM_TABLE_DUMP command (CVE-2006-1516, CVE-2006-1517). Attackers could execute arbitrary code by causing a buffer overflow via specially crafted COM_TABLE_DUMP packets (CVE-2006-1518).

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.9 or a version of Mac OS X 10.3 that does not have Security Update 2007-003 applied. This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

According to its version number, the installation of MySQL on the remote host may be prone to multiple buffer overflows.  The MySQL server is also vulnerable to multiple information disclosure flaws.  An attacker exploiting the overflow would need to be able to authenticate to the MySQL server.  An attacker exploiting the information disclosure flaw would only need to be able to send malformed 'login' packets to the server. This version of MySQL is also prone to a remote Denial of Service (DoS) due to an inability to properly parse a malformed call to the date_format function.

ID	名稱	產品	系列	已發布	已更新	嚴重性
21633	FreeBSD : MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities (4913886c-e875-11da-b9f4-00123ffe8333)	Nessus	FreeBSD Local Security Checks	2006/6/5	2021/1/6	medium
17697	MySQL < 4.0.27 / 4.1.19 / 5.0.21の複数の脆弱性	Nessus	Databases	2011/11/18	2018/11/15	medium
17697	MySQL < 4.0.27 / 4.1.19 / 5.0.21 多個弱點	Nessus	Databases	2011/11/18	2018/11/15	medium
17697	MySQL < 4.0.27 / 4.1.19 / 5.0.21 多种漏洞	Nessus	Databases	2011/11/18	2018/11/15	medium
22613	Debian DSA-1071-1 : mysql - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
22621	Debian DSA-1079-1 : mysql-dfsg - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
17697	MySQL < 4.0.27 / 4.1.19 / 5.0.21 Multiple Vulnerabilities	Nessus	Databases	2011/11/18	2018/11/15	medium
21345	Slackware 10.2 / current : mysql (SSA:2006-129-02)	Nessus	Slackware Local Security Checks	2006/5/13	2021/1/14	medium
21492	FreeBSD : mysql50-server -- COM_TABLE_DUMP arbitrary code execution (a8d8713e-dc83-11da-a22b-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	2006/5/13	2021/1/6	medium
22615	Debian DSA-1073-1 : mysql-dfsg-4.1 - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
27881	Ubuntu 5.10 : mysql-dfsg-4.1 vulnerability (USN-306-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
27356	openSUSE 10 Security Update : mysql (mysql-1312)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	medium
3947	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus Network Monitor	Web Clients	2007/3/13	2019/3/6	high
3527	Oracle MySQL Remote Overflow and Information Disclosure Vulnerabilities	Nessus Network Monitor	Database	2004/8/18	2019/3/6	medium
801163	MySQL Remote Overflow and Information Disclosure Vulnerabilities	Log Correlation Engine	Database			medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium