CVE-2005-0710

2005-05-0204:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

mysql

cve-2005-0710

security vulnerability

udf_init function

nvd

6.5 Medium

AI Score

Confidence

Low

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.969 High

EPSS

Percentile

99.7%

JSON

MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to bypass library path restrictions and execute arbitrary libraries by using INSERT INTO to modify the mysql.func table, which is processed by the udf_init function.

CPENameOperatorVersion
mysql:mysqlmysqleq4.1.10
mysql:mysqlmysqleq4.1.0
mysql:mysqlmysqleq4.1.3
oracle:mysqloracle mysqleq3.23.49
oracle:mysqloracle mysqleq4.0.0
oracle:mysqloracle mysqleq4.0.1
oracle:mysqloracle mysqleq4.0.2
oracle:mysqloracle mysqleq4.0.3
oracle:mysqloracle mysqleq4.0.4
oracle:mysqloracle mysqleq4.0.5

CPE	Name	Operator	Version
mysql:mysql	mysql	eq	4.1.10
mysql:mysql	mysql	eq	4.1.0
mysql:mysql	mysql	eq	4.1.3
oracle:mysql	oracle mysql	eq	3.23.49
oracle:mysql	oracle mysql	eq	4.0.0
oracle:mysql	oracle mysql	eq	4.0.1
oracle:mysql	oracle mysql	eq	4.0.2
oracle:mysql	oracle mysql	eq	4.0.3
oracle:mysql	oracle mysql	eq	4.0.4
oracle:mysql	oracle mysql	eq	4.0.5