Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.5
CVSSv2

CVE-2002-1375

Published: 23/12/2002 Updated: 07/10/2019
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 755
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Oracle

Vulnerability Summary

The COM_CHANGE_USER command in MySQL 3.x prior to 3.23.54, and 4.x to 4.0.6, allows remote malicious users to execute arbitrary code via a long response.

Vulnerable Product Search on Vulmon Subscribe to Product

oracle mysql 3.22.27

oracle mysql 3.22.28

oracle mysql 3.23.24

oracle mysql 3.23.25

oracle mysql 3.23.31

oracle mysql 3.23.34

oracle mysql 3.23.36

oracle mysql 3.23.42

oracle mysql 3.23.43

oracle mysql 3.23.5

oracle mysql 3.23.50

oracle mysql 4.0.1

oracle mysql 4.0.2

symantec veritas netbackup advanced reporter 4.5_fp3

symantec veritas netbackup advanced reporter 4.5_mp1

symantec veritas netbackup global data manager 4.5_mp1

symantec veritas netbackup global data manager 4.5_mp2

oracle mysql 3.22.29

oracle mysql 3.22.30

oracle mysql 3.23.26

oracle mysql 3.23.27

oracle mysql 3.23.37

oracle mysql 3.23.38

oracle mysql 3.23.44

oracle mysql 3.23.45

oracle mysql 3.23.51

oracle mysql 3.23.52

oracle mysql 4.0.3

oracle mysql 4.0.5a

symantec veritas netbackup advanced reporter 4.5_mp2

symantec veritas netbackup advanced reporter 4.5_mp3

symantec veritas netbackup global data manager 4.5_mp3

oracle mysql 3.22.32

oracle mysql 3.23.10

oracle mysql 3.23.28

oracle mysql 3.23.29

oracle mysql 3.23.39

oracle mysql 3.23.4

oracle mysql 3.23.46

oracle mysql 3.23.47

oracle mysql 3.23.53

oracle mysql 3.23.53a

symantec veritas netbackup advanced reporter 3.4

symantec veritas netbackup advanced reporter 4.5

symantec veritas netbackup global data manager 4.5

symantec veritas netbackup global data manager 4.5_fp1

oracle mysql 3.22.26

oracle mysql 3.23.2

oracle mysql 3.23.23

oracle mysql 3.23.3

oracle mysql 3.23.30

oracle mysql 3.23.40

oracle mysql 3.23.41

oracle mysql 3.23.48

oracle mysql 3.23.49

oracle mysql 3.23.8

oracle mysql 3.23.9

oracle mysql 4.0.0

symantec veritas netbackup advanced reporter 4.5_fp1

symantec veritas netbackup advanced reporter 4.5_fp2

symantec veritas netbackup global data manager 4.5_fp2

symantec veritas netbackup global data manager 4.5_fp3

Vendor Advisories

Debian Security Advisories: DSA-212-1 mysql -- multiple problems
While performing an audit of MySQL e-matters found several problems: signed/unsigned problem in COM_TABLE_DUMP Two sizes were taken as signed integers from a request and then cast to unsigned integers without checking for negative numbers Since the resulting numbers where used for a memcpy() operation this could lead to memory corrupti ...

Exploits

Exploit DB: MySQL 3.23.x/4.0.x - COM_CHANGE_USER Password Memory Corruption
source: wwwsecurityfocuscom/bid/6375/info MySQL is prone to a memory corruption vulnerability in the COM_CHANGE_USER command Due to a lack of sufficient bounds checking for client responses to password authentication challenges, it may be possible to corrupt sensitive regions of memory It has been reported that it is possible to overw ...

Github Repositories

https://github.com/365sec/trule

Next generation host vulnerability scanning based on version matching rule base

trule Next generation host vulnerability scanning based on version matching rule base We define the following rules for version based vulnerability detection <Vulns> <Vulnerability added="2004-12-22" id="mysql-bug-report-symlink" modified="2013-08-22" published="2004-05-04" version="20"> <

References

NVD-CWE-Otherhttp://www.linuxsecurity.com/advisories/engarde_advisory-2660.htmlhttp://www.securityfocus.com/bid/6375http://security.e-matters.de/advisories/042002.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000555http://www.debian.org/security/2002/dsa-212http://www.securityfocus.com/advisories/5269http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:087http://www.redhat.com/support/errata/RHSA-2002-288.htmlhttp://www.redhat.com/support/errata/RHSA-2002-289.htmlhttp://www.redhat.com/support/errata/RHSA-2003-166.htmlhttp://www.novell.com/linux/security/advisories/2003_003_mysql.htmlhttp://www.trustix.net/errata/misc/2002/TSL-2002-0086-mysql.asc.txthttp://marc.info/?l=bugtraq&m=104004857201968&w=2http://marc.info/?l=bugtraq&m=104005886114500&w=2http://marc.info/?l=bugtraq&m=103971644013961&w=2https://exchange.xforce.ibmcloud.com/vulnerabilities/10848https://nvd.nist.govhttps://www.debian.org/security/./dsa-212https://github.com/365sec/trulehttps://www.exploit-db.com/exploits/22085/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-32886insecure direct object referenceCVE-2024-34342file inclusionCVE-2024-34562CVE-2024-34347CVE-2024-26026CVE-2024-4647unprivileged
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook