Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.6
CVSSv2

CVE-2006-0903

Published: 27/02/2006 Updated: 07/11/2023
CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9
VMScore: 465
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Mysql

Vulnerability Summary

MySQL 5.0.18 and previous versions allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.

Vulnerable Product Search on Vulmon Subscribe to Product

mysql mysql 5.0.5

mysql mysql 5.0.10

mysql mysql 5.0.15

mysql mysql 5.0.17

mysql mysql 4.1.13

mysql mysql 4.1.15

mysql mysql 4.1.8

mysql mysql 4.1.14

mysql mysql 4.1.12

mysql mysql 4.1.10

mysql mysql 5.0.2

mysql mysql 5.0.1

mysql mysql 4.1.0

mysql mysql 5.0.4

mysql mysql 4.1.3

mysql mysql 5.0.16

oracle mysql 3.23

oracle mysql 3.23.0

oracle mysql 3.23.1

oracle mysql 3.23.2

oracle mysql 3.23.3

oracle mysql 3.23.4

oracle mysql 3.23.5

oracle mysql 3.23.6

oracle mysql 3.23.7

oracle mysql 3.23.8

oracle mysql 3.23.9

oracle mysql 3.23.10

oracle mysql 3.23.11

oracle mysql 3.23.12

oracle mysql 3.23.13

oracle mysql 3.23.14

oracle mysql 3.23.15

oracle mysql 3.23.16

oracle mysql 3.23.17

oracle mysql 3.23.18

oracle mysql 3.23.19

oracle mysql 3.23.20

oracle mysql 3.23.21

oracle mysql 3.23.22

oracle mysql 3.23.23

oracle mysql 3.23.24

oracle mysql 3.23.25

oracle mysql 3.23.26

oracle mysql 3.23.27

oracle mysql 3.23.28

oracle mysql 3.23.29

oracle mysql 3.23.30

oracle mysql 3.23.31

oracle mysql 3.23.32

oracle mysql 3.23.33

oracle mysql 3.23.34

oracle mysql 3.23.35

oracle mysql 3.23.36

oracle mysql 3.23.37

oracle mysql 3.23.38

oracle mysql 3.23.39

oracle mysql 3.23.40

oracle mysql 3.23.41

oracle mysql 3.23.42

oracle mysql 3.23.43

oracle mysql 3.23.44

oracle mysql 3.23.45

oracle mysql 3.23.46

oracle mysql 3.23.47

oracle mysql 3.23.48

oracle mysql 3.23.49

oracle mysql 3.23.50

oracle mysql 3.23.51

oracle mysql 3.23.52

oracle mysql 3.23.53

oracle mysql 3.23.54

oracle mysql 3.23.55

oracle mysql 3.23.56

oracle mysql 3.23.57

oracle mysql 3.23.58

oracle mysql 3.23.59

oracle mysql 4.0.0

oracle mysql 4.0.1

oracle mysql 4.0.2

oracle mysql 4.0.3

oracle mysql 4.0.4

oracle mysql 4.0.5

oracle mysql 4.0.5a

oracle mysql 4.0.6

oracle mysql 4.0.7

oracle mysql 4.0.8

oracle mysql 4.0.9

oracle mysql 4.0.10

oracle mysql 4.0.11

oracle mysql 4.0.12

oracle mysql 4.0.13

oracle mysql 4.0.14

oracle mysql 4.0.15

oracle mysql 4.0.16

oracle mysql 4.0.17

oracle mysql 4.0.18

oracle mysql 4.0.19

oracle mysql 4.0.20

oracle mysql 4.0.21

oracle mysql 4.0.23

oracle mysql 4.0.24

oracle mysql 4.0.25

oracle mysql 4.0.26

oracle mysql 4.0.27

oracle mysql 4.1.0

oracle mysql 4.1.2

oracle mysql 4.1.3

oracle mysql 4.1.4

oracle mysql 4.1.5

oracle mysql 4.1.6

oracle mysql 4.1.7

oracle mysql 4.1.9

oracle mysql 4.1.11

oracle mysql 4.1.16

oracle mysql 4.1.17

oracle mysql 4.1.18

oracle mysql 4.1.19

oracle mysql 5.0.0

oracle mysql 5.0.3

oracle mysql 5.0.6

oracle mysql 5.0.11

oracle mysql 5.0.12

oracle mysql 5.0.13

oracle mysql 5.0.14

oracle mysql 5.0.18

oracle mysql 5.0.7

oracle mysql 5.0.8

oracle mysql 5.0.9

Vendor Advisories

Ubuntu Security Notice: mysql-dfsg vulnerability
USN-274-1 fixed a logging bypass in the MySQL server Unfortunately it was determined that the original update was not sufficient to completely fix the vulnerability, thus another update is necessary We apologize for the inconvenience ...
Ubuntu Security Notice: mysql-dfsg vulnerability
A logging bypass was discovered in the MySQL query parser A local attacker could exploit this by inserting NUL characters into query strings (even into comments), which would cause the query to be logged incompletely ...
Debian Security Advisories: DSA-1073-1 mysql-dfsg-4.1 -- several vulnerabilities
Several vulnerabilities have been discovered in MySQL, a popular SQL database The Common Vulnerabilities and Exposures Project identifies the following problems: CVE-2006-0903 Improper handling of SQL queries containing the NULL character allows local users to bypass logging mechanisms CVE-2006-1516 Usernames without a trailing null ...
Debian Security Advisories: DSA-1079-1 mysql-dfsg -- several vulnerabilities
Several vulnerabilities have been discovered in MySQL, a popular SQL database The Common Vulnerabilities and Exposures Project identifies the following problems: CVE-2006-0903 Improper handling of SQL queries containing the NULL character allows local users to bypass logging mechanisms CVE-2006-1516 Usernames without a trailing null ...
Debian Security Advisories: DSA-1071-1 mysql -- several vulnerabilities
Several vulnerabilities have been discovered in MySQL, a popular SQL database The Common Vulnerabilities and Exposures Project identifies the following problems: CVE-2006-0903 Improper handling of SQL queries containing the NULL character allows local users to bypass logging mechanisms CVE-2006-1516 Usernames without a trailing null ...

Exploits

Exploit DB: MySQL 5.0.18 - Query Logging Bypass
source: wwwsecurityfocuscom/bid/16850/info MySQL is prone to a query-logging-bypass vulnerability This issue is due to a discrepancy between the handling of NULL bytes in the 'mysql_real_query()' function and in the query-logging functionality This issue allows attackers to bypass the query-logging functionality of the database so they ...

References

NVD-CWE-Otherhttp://rst.void.ru/papers/advisory39.txthttp://secunia.com/advisories/19034http://www.securityfocus.com/bid/16850http://securitytracker.com/id?1015693http://bugs.mysql.com/bug.php?id=17667http://secunia.com/advisories/19502http://secunia.com/advisories/19814http://www.debian.org/security/2006/dsa-1071http://www.debian.org/security/2006/dsa-1073http://secunia.com/advisories/20241http://secunia.com/advisories/20253http://www.debian.org/security/2006/dsa-1079http://secunia.com/advisories/20333http://www.redhat.com/support/errata/RHSA-2006-0544.htmlhttp://secunia.com/advisories/20625http://www.ubuntu.com/usn/usn-274-2http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0653.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0083.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:064http://secunia.com/advisories/30351http://www.redhat.com/support/errata/RHSA-2008-0364.htmlhttp://www.vupen.com/english/advisories/2006/0752https://exchange.xforce.ibmcloud.com/vulnerabilities/24966https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9915https://usn.ubuntu.com/274-1/https://nvd.nist.govhttps://usn.ubuntu.com/274-2/https://www.exploit-db.com/exploits/27326/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
encryptionCVE-2024-4331CVE-2024-26925arbitrary codeCVE-2006-4304CVE-2024-25458CVE-2024-27077reflected XSSCVE-2024-4059
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook