CVE-2003-1331 - Stack-based buffer overflow in the mysql_real_connect function in the MySql client library (libmysql

CVE-2003-1331

Summary

Stack-based buffer overflow in the mysql_real_connect function in the MySql client library (libmysqlclient) 4.0.13 and earlier allows local users to execute arbitrary code via a long socket name, a different vulnerability than CVE-2001-1453.

References

Vulnerable Configurations

cpe:2.3:a:oracle:mysql:3.23.28:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:3.23.28:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.7:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.7:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.8:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.8:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.9:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.9:gamma:*:*:*:*:*:*

CVSS

Base:	4.0 (as of 07-10-2019 - 16:42)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:N/I:P/A:P

refmap via4

bid	7887
confirm	http://bugs.mysql.com/bug.php?id=564
fulldisc	20030612 libmysqlclient 4.x and below mysql_real_connect() buffer overflow.
xf	mysql-mysqlrealconnect-bo(12337)

statements via4

contributor	Joshua Bressers
lastmodified	2007-06-29
organization	Red Hat
statement	Red Hat does not consider this issue to be a security vulnerability since no trust boundary is crossed. The user must voluntarily interact with the attack mechanism to exploit this flaw, with the result being the ability to run code as themselves.

Last major update

07-10-2019 - 16:42

Published

31-12-2003 - 05:00

Last modified

07-10-2019 - 16:42