Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.

Updated MySQL server packages fix a buffer overflow vulnerability.

MySQL is a multi-user, multi-threaded SQL database server.

Frank Denis reported a bug in unpatched versions of MySQL prior to version 3.23.58. Passwords for MySQL users are stored in the Password field of the user table. Under this bug, a Password field with a value greater than 16 characters can cause a buffer overflow. It may be possible for an attacker with the ability to modify the user table to exploit this buffer overflow to execute arbitrary code as the MySQL user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0780 to this issue.

Users of MySQL are advised to upgrade to these erratum packages containing MySQL 3.23.58, which is not vulnerable to this issue.

MySQL, a popular relational database system, contains a buffer overflow condition which could be exploited by a user who has permission to execute 'ALTER TABLE' commands on the tables in the 'mysql' database. If successfully exploited, this vulnerability could allow the attacker to execute arbitrary code with the privileges of the mysqld process (by default, user 'mysql'). Since the 'mysql' database is used for MySQL's internal record keeping, by default the mysql administrator 'root' is the only user with permission to alter its tables.

A buffer overflow was discovered in MySQL that could be executed by any user with 'ALTER TABLE' privileges on the 'mysql' database. If successfully exploited, the attacker could execute arbitrary code with the privileges of the user running the mysqld process (mysqld). The 'mysql' database is used by MySQL for internal record keeping and by default only the 'root' user, or MySQL administrative account, has permission to alter its tables.

This vulnerability was corrected in MySQL 4.0.15 and all previous versions are vulnerable. These packages have been patched to correct the problem.

According to its banner, the version of MySQL installed on the remote host fails to validate the length of a user-supplied password in the 'User' table in the 'get_salt_from_password()' function.  Using a specially crafted value for a new password, an authenticated attacker with the 'ALTER DATABASE' privilege may be able to leverage this issue to trigger a buffer overflow and execute arbitrary code subject to the privileges under which the database service runs.

ID	Name	Product	Family	Severity
15652	RHEL 2.1 : mysql (RHSA-2003:282)	Nessus	Red Hat Local Security Checks	high
15218	Debian DSA-381-1 : mysql - buffer overflow	Nessus	Debian Local Security Checks	high
14076	Mandrake Linux Security Advisory : MySQL (MDKSA-2003:094)	Nessus	Mandriva Local Security Checks	high
11842	MySQL sql_acl.cc get_salt_from_password Function Password Handling Remote Overflow	Nessus	Databases	high

Detections

Analytics

CVE-2003-0780

critical

Tenable Plugins

high

high

high

high