Main Menu
Network
Sponsor
Top 10 Sites
Partners
|
|
Top Submit newsSubscribe 
Communication | Computer Crime | Digital Audio, Video, Photo | General News | Hardware | Internet | Mobile | PDA | Security | Software | Vulnerability |
Previous articleBack to news listNext article
| Sponsored links | Want to become one of our authors and see your work published on ALLSeek.iNFO ?
| | MySQL acl_init() Buffer Overflow Permits Remote Authenticated Administrators to Execute Arbitrary Code |
|---|
Categorie: Vulnerability
Posted: 2003-09-12 by ReCall
Views: 371
Source: Click here
| Current Rating: Not rated
|
| | Details |
|---|
Description: A buffer overflow vulnerability was reported in MySQL in the processing of user passwords. An authenticated administrator can execute arbitrary code on the system.
It is reported that a function that checks MySQL user passwords does not properly validate the length of a user-supplied password field. An authenticated user with administrative privileges can set a "Password" field to a specially crafted value that is longer than 16 characters to trigger an overlow and execute arbitrary code. The code will run with the privileges of the MySQL server process.
The report indicates that an administrator can invoke a function (such as 'FLUSH PRIVILEGES') to trigger an overflow in acl_init(). The exploit password length must be set to a multiple of 8.
A demonstration exploit example is provided in the Source Message.
According to the report, this has been confirmed on on OpenBSD 3.3-RELEASE, FreeBSD 4.8-STABLE, and Gentoo Linux 1.4.
Impact: A remote authenticated administrator can execute arbitrary code on the system with the privileges of the MySQL
process.
Solution: The vendor has released a fixed version (4.0.15), available at:
http://www.mysql.com/downloads/mysql-4.0.html
| | Syndication |
|---|
Permalink Email this
The URI to TrackBack this entry is:
http://allseek.info/news/trackback.php?id=423
| | User comments (post your comments ) |
|---|
Only registerd members can post comments and articles
|
| Previous articleBack to news listNext article
|
|
|
|
InterJOB.su
|
