MySQL 3.23.x/4.0.x COM_CHANGE_USER Password Memory Corruption Vulnerability

                                                source: http://www.securityfocus.com/bid/6375/info

MySQL is prone to a memory corruption vulnerability in the COM_CHANGE_USER command. 

Due to a lack of sufficient bounds checking for client responses to password authentication challenges, it may be possible to corrupt sensitive regions of memory. It has been reported that it is possible to overwrite the saved instruction pointer on the stack with bytes generated by the random number generator of the password verification algorithm. Theoretically, an attacker could leverage such a condition to cause execution of arbitrary code in the security context of the MySQL server process.

It is believed the attacker must be able to issue a COM_CHANGE_USER command to exploit this issue, so having access to a valid database user account may be a prerequisite for exploitation. It is not known if this condition exists when an unauthenticated user attempts to authenticate normally.

http://www.exploit-db.com/sploits/22085.tgz