Lucene search

K
zdiLucas Leong (@_wmliang_) of Trend Micro Zero Day InitiativeZDI-22-112
HistoryJan 21, 2022 - 12:00 a.m.

Oracle MySQL Cluster Data Node Stack-based Buffer Overflow Remote Code Execution Vulnerability

2022-01-2100:00:00
Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative
www.zerodayinitiative.com
10
vulnerability
remote code execution
oracle
mysql cluster
data node
authentication
flaw
data validation
stack-based buffer
arbitrary code

EPSS

0.001

Percentile

46.9%

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle MySQL Cluster. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of Data Node jobs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.

EPSS

0.001

Percentile

46.9%