J-Security Center

Title: MySQL 'sql_parse.cc' Multiple Format String Vulnerabilities

Severity: HIGH

Description:

MySQL is an open-source SQL database available for multiple operating systems.

MySQL is prone to multiple format-string vulnerabilities that occur when logging requests for 'COM_CREATE_DB' and 'COM_DROP_DB'. Specifically, the 'libmysqld/sql_parse.cc' file fails to filter format-string characters before calling the 'mysql_log.write()' function.

Note that for an exploit to succeed, MySQL logging must be enabled and attackers must have valid authentication credentials.

Attackers can leverage these issues to execute arbitrary code within the context of the vulnerable application. Failed attacks will likely cause denial-of-service conditions.

MySQL 4.0.0 through 5.0.75 are vulnerable; other versions may also be affected.

Affected Products:

  • Conectiva Linux 10.0.0
  • Debian Linux 3.1.0
  • Debian Linux 3.1.0 alpha
  • Debian Linux 3.1.0 amd64
  • Debian Linux 3.1.0 arm
  • Debian Linux 3.1.0 hppa
  • Debian Linux 3.1.0 ia-32
  • Debian Linux 3.1.0 ia-64
  • Debian Linux 3.1.0 m68k
  • Debian Linux 3.1.0 mips
  • Debian Linux 3.1.0 mipsel
  • Debian Linux 3.1.0 ppc
  • Debian Linux 3.1.0 s/390
  • Debian Linux 3.1.0 sparc
  • MandrakeSoft Corporate Server 3.0.0
  • MandrakeSoft Corporate Server 3.0.0 x86_64
  • MandrakeSoft Corporate Server 4.0
  • MandrakeSoft Corporate Server 4.0.0 x86_64
  • MandrakeSoft Enterprise Server 5
  • MandrakeSoft Enterprise Server 5 x86_64
  • MandrakeSoft Linux Mandrake 10.0.0
  • MandrakeSoft Linux Mandrake 10.0.0 amd64
  • MandrakeSoft Linux Mandrake 10.1.0
  • MandrakeSoft Linux Mandrake 10.1.0 x86_64
  • MandrakeSoft Linux Mandrake 2008.1
  • MandrakeSoft Linux Mandrake 2008.1 x86_64
  • MandrakeSoft Linux Mandrake 2009.0
  • MandrakeSoft Linux Mandrake 2009.0 x86_64
  • MandrakeSoft Linux Mandrake 9.1.0
  • MandrakeSoft Linux Mandrake 9.1.0 ppc
  • MandrakeSoft Linux Mandrake 9.2.0
  • MandrakeSoft Linux Mandrake 9.2.0 amd64
  • MySQL AB MySQL 4.0.0 .0
  • MySQL AB MySQL 4.0.1
  • MySQL AB MySQL 4.0.10
  • MySQL AB MySQL 4.0.11
  • MySQL AB MySQL 4.0.12
  • MySQL AB MySQL 4.0.13
  • MySQL AB MySQL 4.0.14
  • MySQL AB MySQL 4.0.15
  • MySQL AB MySQL 4.0.17
  • MySQL AB MySQL 4.0.18
  • MySQL AB MySQL 4.0.19
  • MySQL AB MySQL 4.0.2
  • MySQL AB MySQL 4.0.20
  • MySQL AB MySQL 4.0.21
  • MySQL AB MySQL 4.0.23
  • MySQL AB MySQL 4.0.24
  • MySQL AB MySQL 4.0.25
  • MySQL AB MySQL 4.0.26
  • MySQL AB MySQL 4.0.27
  • MySQL AB MySQL 4.0.3
  • MySQL AB MySQL 4.0.4
  • MySQL AB MySQL 4.0.5
  • MySQL AB MySQL 4.0.6
  • MySQL AB MySQL 4.0.7
  • MySQL AB MySQL 4.0.8
  • MySQL AB MySQL 4.0.9
  • MySQL AB MySQL 4.1.0 .11
  • MySQL AB MySQL 4.1.0-0
  • MySQL AB MySQL 4.1.1
  • MySQL AB MySQL 4.1.10a
  • MySQL AB MySQL 4.1.11
  • MySQL AB MySQL 4.1.11a
  • MySQL AB MySQL 4.1.12
  • MySQL AB MySQL 4.1.13
  • MySQL AB MySQL 4.1.15
  • MySQL AB MySQL 4.1.16
  • MySQL AB MySQL 4.1.18
  • MySQL AB MySQL 4.1.19
  • MySQL AB MySQL 4.1.2
  • MySQL AB MySQL 4.1.20
  • MySQL AB MySQL 4.1.21
  • MySQL AB MySQL 4.1.23
  • MySQL AB MySQL 4.1.24
  • MySQL AB MySQL 4.1.4
  • MySQL AB MySQL 4.1.5
  • MySQL AB MySQL 4.1.7
  • MySQL AB MySQL 5.0
  • MySQL AB MySQL 5.0.1
  • MySQL AB MySQL 5.0.18
  • MySQL AB MySQL 5.0.19
  • MySQL AB MySQL 5.0.2
  • MySQL AB MySQL 5.0.20
  • MySQL AB MySQL 5.0.21
  • MySQL AB MySQL 5.0.22
  • MySQL AB MySQL 5.0.24
  • MySQL AB MySQL 5.0.26
  • MySQL AB MySQL 5.0.27
  • MySQL AB MySQL 5.0.3
  • MySQL AB MySQL 5.0.32
  • MySQL AB MySQL 5.0.33
  • MySQL AB MySQL 5.0.36
  • MySQL AB MySQL 5.0.37
  • MySQL AB MySQL 5.0.38
  • MySQL AB MySQL 5.0.39
  • MySQL AB MySQL 5.0.4
  • MySQL AB MySQL 5.0.40
  • MySQL AB MySQL 5.0.42
  • MySQL AB MySQL 5.0.44
  • MySQL AB MySQL 5.0.45
  • MySQL AB MySQL 5.0.46
  • MySQL AB MySQL 5.0.47
  • MySQL AB MySQL 5.0.48
  • MySQL AB MySQL 5.0.49
  • MySQL AB MySQL 5.0.50
  • MySQL AB MySQL 5.0.51
  • MySQL AB MySQL 5.0.52
  • MySQL AB MySQL 5.0.60
  • MySQL AB MySQL 5.0.66
  • MySQL AB MySQL 5.0.75
  • OpenPKG OpenPKG 1.3.0
  • OpenPKG OpenPKG Current
  • Trustix Secure Linux 2.0.0
  • Ubuntu Ubuntu Linux 4.1.0 ia32
  • Ubuntu Ubuntu Linux 4.1.0 ia64
  • Ubuntu Ubuntu Linux 4.1.0 ppc
  • Ubuntu Ubuntu Linux 5.0.0 4 amd64
  • Ubuntu Ubuntu Linux 5.0.0 4 i386
  • Ubuntu Ubuntu Linux 5.0.0 4 powerpc

References:

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.