ID CVE-2003-1331
Summary Stack-based buffer overflow in the mysql_real_connect function in the MySql client library (libmysqlclient) 4.0.13 and earlier allows local users to execute arbitrary code via a long socket name, a different vulnerability than CVE-2001-1453.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:mysql:3.23.28:gamma:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql:3.23.28:gamma:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql:4.0.7:gamma:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql:4.0.7:gamma:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql:4.0.8:gamma:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql:4.0.8:gamma:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql:4.0.9:gamma:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql:4.0.9:gamma:*:*:*:*:*:*
CVSS
Base: 4.0 (as of 07-10-2019 - 16:42)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:H/Au:N/C:N/I:P/A:P
refmap via4
bid 7887
confirm http://bugs.mysql.com/bug.php?id=564
fulldisc 20030612 libmysqlclient 4.x and below mysql_real_connect() buffer overflow.
xf mysql-mysqlrealconnect-bo(12337)
statements via4
contributor Joshua Bressers
lastmodified 2007-06-29
organization Red Hat
statement Red Hat does not consider this issue to be a security vulnerability since no trust boundary is crossed. The user must voluntarily interact with the attack mechanism to exploit this flaw, with the result being the ability to run code as themselves.
Last major update 07-10-2019 - 16:42
Published 31-12-2003 - 05:00
Back to Top