MySQL 3.23.x/4.0.x - COM_CHANGE_USER Password Memory Corruption
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | CAN-2002-1375 | 6 Aug 202410:46 | – | cve |
| CVE-2002-1375 | 1 Sep 200404:00 | – | cve |
 | CVE-2002-1375 | 1 Sep 200404:00 | – | cvelist |
 | Debian DSA-212-1 : mysql - multiple problems | 29 Sep 200400:00 | – | nessus |
| Mandrake Linux Security Advisory : MySQL (MDKSA-2002:087) | 31 Jul 200400:00 | – | nessus |
| MySQL < 3.23.54 / 4.0.6 Multiple Vulnerabilities | 12 Dec 200200:00 | – | nessus |
| RHEL 2.1 : mysql (RHSA-2002:289) | 6 Jul 200400:00 | – | nessus |
 | CVE-2002-1375 | 23 Dec 200205:00 | – | nvd |
 | Debian Security Advisory DSA 212-1 (mysql) | 17 Jan 200800:00 | – | openvas |
| Debian Security Advisory DSA 212-1 (mysql) | 17 Jan 200800:00 | – | openvas |
10
source: https://www.securityfocus.com/bid/6375/info
MySQL is prone to a memory corruption vulnerability in the COM_CHANGE_USER command.
Due to a lack of sufficient bounds checking for client responses to password authentication challenges, it may be possible to corrupt sensitive regions of memory. It has been reported that it is possible to overwrite the saved instruction pointer on the stack with bytes generated by the random number generator of the password verification algorithm. Theoretically, an attacker could leverage such a condition to cause execution of arbitrary code in the security context of the MySQL server process.
It is believed the attacker must be able to issue a COM_CHANGE_USER command to exploit this issue, so having access to a valid database user account may be a prerequisite for exploitation. It is not known if this condition exists when an unauthenticated user attempts to authenticate normally.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22085.tgzData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Oct 2012 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 27.5
EPSS0.23511