CVE-2005-0709
NoneCVSS
—
EPSS
18.4%
Published
May 2, 2005
CISA due date
—
The record
MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated by using strcat, on_exit, and exit.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:3.0 | mysql | 0 | 3.23.49-8.11 |
| Red Hat:enterprise_linux:3::as | mysql | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::as | mysql-bench | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::as | mysql-debuginfo | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::as | mysql-devel | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::desktop | mysql | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::desktop | mysql-bench | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::desktop | mysql-debuginfo | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::desktop | mysql-devel | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::es | mysql | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::es | mysql-bench | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::es | mysql-debuginfo | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::es | mysql-devel | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::ws | mysql | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::ws | mysql-bench | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::ws | mysql-debuginfo | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:3::ws | mysql-devel | 0 | 0:3.23.58-15.RHEL3.1 |
| Red Hat:enterprise_linux:4::as | mysql | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::as | mysql-bench | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::as | mysql-debuginfo | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::as | mysql-devel | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::as | mysql-server | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::desktop | mysql | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::desktop | mysql-bench | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::desktop | mysql-debuginfo | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::desktop | mysql-devel | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::desktop | mysql-server | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::es | mysql | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::es | mysql-bench | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::es | mysql-debuginfo | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::es | mysql-devel | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::es | mysql-server | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::ws | mysql | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::ws | mysql-bench | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::ws | mysql-debuginfo | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::ws | mysql-devel | 0 | 0:4.1.10a-1.RHEL4.1 |
| Red Hat:enterprise_linux:4::ws | mysql-server | 0 | 0:4.1.10a-1.RHEL4.1 |
Related vulnerabilities
- CVE-2006-1516 The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to… Also affects mysql
- CVE-2006-1518 Buffer overflow in the open_table function in sql_base.cc in MySQL 5.0.x up to 5.0.20… Also affects mysql
- CVE-2005-0710 MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with… Also affects mysql
- CVE-2004-0835 MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1… Also affects mysql
- CVE-2003-0780 Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier… Also affects mysql
- CVE-2002-1374 The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows… Also affects mysql
- CVE-2002-1375 The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote… Also affects mysql
- CVE-2010-3681 Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to… Also affects mysql