CVE-2005-0709

Public PoC / Exploit (2)

Exploit-DBMySQL 4.x - CREATE FUNCTION Arbitrary libc Code Execution TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated by using strcat, on_exit, and exit.

Weaknesses (CWE)

CWE-94

Affected Products (34)

mysql · mysqlvulnerable

oracle · mysqlvulnerable

References (20)

http://archives.neohapsis.com/archives/vulnwatch/2005-q1/0084.html

Exploit

http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html

http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html

http://marc.info/?l=bugtraq&m=111066115808506&w=2

http://sunsolve.sun.com/search/document.do?assetkey=1-26-101864-1

http://www.debian.org/security/2005/dsa-707

Patch

http://www.gentoo.org/security/en/glsa/glsa-200503-19.xml

Patch

http://www.mandriva.com/security/advisories?name=MDKSA-2005:060

http://www.novell.com/linux/security/advisories/2005_19_mysql.html

Patch

http://www.redhat.com/support/errata/RHSA-2005-334.html

http://www.redhat.com/support/errata/RHSA-2005-348.html

http://www.securityfocus.com/bid/12781

ExploitPatch

http://www.trustix.org/errata/2005/0009/

Patch

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10479

https://usn.ubuntu.com/96-1/

http://archives.neohapsis.com/archives/vulnwatch/2005-q1/0084.html

Exploit

http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html

http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html

http://marc.info/?l=bugtraq&m=111066115808506&w=2

http://sunsolve.sun.com/search/document.do?assetkey=1-26-101864-1