vulnwire
4.6med

CVE-2005-07091 exploit

MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
4.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
18.4%
percentile 97%
Public exploits
1
Exploit-DB

MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated by using strcat, on_exit, and exit.

Exploit prediction (EPSS)

18.44% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

Exploits and detections

  • EDB-25209 MySQL 4.x - CREATE FUNCTION Arbitrary libc Code Execution · remote · 2005-03-11

CVSS scores

Assigned byVersionScoreVector
NVD2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code
Technology feeds
MySQL (RSS, critical only)

References

  • trustix.org /errata/2005/0009/ · vendor-advisory, x_refsource_TRUSTIX, x_transferred
  • debian.org /security/2005/dsa-707 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • marc.info /?l=bugtraq&m=111066115808506&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • archives.neohapsis.com /archives/vulnwatch/2005-q1/0084.html · mailing-list, x_refsource_VULNWATCH, x_transferred
  • redhat.com /support/errata/RHSA-2005-334.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-101864-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • novell.com /linux/security/advisories/2005_19_mysql.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • usn.ubuntu.com /96-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • redhat.com /support/errata/RHSA-2005-348.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.apple.com /archives/security-announce/2005/Aug/msg00000.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2005:060 · vendor-advisory, x_refsource_MANDRAKE, x_transferred
  • gentoo.org /security/en/glsa/glsa-200503-19.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10479 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • lists.apple.com /archives/security-announce/2005//Aug/msg00001.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • securityfocus.com /bid/12781 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.