Authorization Bypass

2020-04-1000:37:01

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

8.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

JSON

mysql is vulnerable to authorization bypass. The vulnerability exists through multiple format string flaws were found in the way the MySQL server logs user commands when creating and deleting databases. A remote, authenticated attacker with permissions to CREATE and DROP databases could use these flaws to formulate a specifically-crafted SQL command that would cause a temporary denial of service (open connections to mysqld are terminated).

CPENameOperatorVersion
perl-dbieq1.52__2.el5
perl-dbieq1.607__3.el5s2
perl-dbieq1.54__2.el5s2
perl-dbieq1.604__1.el5s2
php-peareq1.4.9__4.el5.1
php-peareq1.5.1__2.el5s2
php-peareq1.7.2__2.el5s2
php-peareq1.4.9__6.el5
mysqleq5.0.22__2.2.el5_1.1
mysqleq4.1.20__3.RHEL4.1.el4_6.1

Name	Operator	Version
perl-dbi	eq	1.52__2.el5
perl-dbi	eq	1.607__3.el5s2
perl-dbi	eq	1.54__2.el5s2
perl-dbi	eq	1.604__1.el5s2
php-pear	eq	1.4.9__4.el5.1
php-pear	eq	1.5.1__2.el5s2
php-pear	eq	1.7.2__2.el5s2
php-pear	eq	1.4.9__6.el5
mysql	eq	5.0.22__2.2.el5_1.1
mysql	eq	4.1.20__3.RHEL4.1.el4_6.1