Vulnerabilities > CVE-2005-2573

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
mysql
oracle
nessus
NVD
Published: 2005-08-16
Updated: 2023-11-07

Summary

The mysql_create_function function in sql_udf.cc for MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta, when running on Windows, uses an incomplete blacklist in a directory traversal check, which allows attackers to include arbitrary files via the backslash (\) character.

Vulnerable Configurations

Part Description Count
Application
Mysql
7
Application
Oracle
31

Nessus

NASL familyDatabases
NASL idMYSQL_INIT_SYMS_BUFFER_OVERFLOW.NASL
descriptionAccording to its version number, the installation of MySQL on the remote host is potentially affected by two flaws : - A buffer overflow can be triggered when copying the name of a user-defined function into a stack-based buffer. With sufficient access to create a user-defined function, an attacker may be able to exploit this and execute arbitrary code within the context of the affected database server process. (CVE-2005-2558) - The mysql_create_function is not fully protected against directory traversal attacks. On Windows, arbitrary files can be included by using backslash characters. (CVE-2005-2573)
last seen2020-06-01
modified2020-06-02
plugin id19416
published2005-08-10
reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/19416
titleMySQL < 4.0.25 / 4.1.13 / 5.0.7 Multiple Vulnerabilies

References