Buffer overflow in the open_table function in sql_base.cc in MySQL 5.0.x up to 5.0.20 might allow remote attackers to execute arbitrary code via crafted COM_TABLE_DUMP packets with invalid length values.

The version of MySQL installed on the remote host is earlier than 4.0.27 / 4.1.19 / 5.0.21.  As such, it is potentially affected by the following vulnerabilities :

  - A remote attacker may be able to read portions of memory     by sending a specially crafted login packet in which the     username does not have a trailing NULL. (CVE-2006-1516)

  - A remote attacker may be able to read portions of memory     by sending a specially crafted COM_TABLE_DUMP request     with an incorrect packet length. (CVE-2006-1517)

  - A buffer overflow in the 'open_table()' function could     allow a remote, authenticated attacker to execute     arbitrary code via specially crafted COM_TABLE_DUMP     packets. (CVE-2006-1518)

MySQL did not correctly handle NULL as the second argument to the str_to_date() function. An authenticated user could exploit this to crash the server.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Attackers could read portions of memory by using a user name with trailing null byte or via COM_TABLE_DUMP command (CVE-2006-1516, CVE-2006-1517). Attackers could execute arbitrary code by causing a buffer overflow via specially crafted COM_TABLE_DUMP packets (CVE-2006-1518).

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.9 or a version of Mac OS X 10.3 that does not have Security Update 2007-003 applied. This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

Several vulnerabilities have been discovered in MySQL, a popular SQL database. The Common Vulnerabilities and Exposures Project identifies the following problems :

  - CVE-2006-0903     Improper handling of SQL queries containing the NULL     character allows local users to bypass logging     mechanisms.

  - CVE-2006-1516     Usernames without a trailing null byte allow remote     attackers to read portions of memory.

  - CVE-2006-1517     A request with an incorrect packet length allows remote     attackers to obtain sensitive information.

  - CVE-2006-1518     Specially crafted request packets with invalid length     values allow the execution of arbitrary code.

The following vulnerability matrix shows which version of MySQL in which distribution has this problem fixed :

                   woody            sarge            sid                mysql            3.23.49-8.15     n/a              n/a                mysql-dfsg       n/a              4.0.24-10sarge2  n/a                mysql-dfsg-4.1   n/a              4.1.11a-4sarge3  n/a                mysql-dfsg-5.0   n/a              n/a              5.0.21-3

Secunia reports :

MySQL have some vulnerabilities, which can be exploited by malicious users to disclose potentially sensitive information and compromise a vulnerable system.

1) An error within the code that generates an error response to an invalid COM_TABLE_DUMP packet can be exploited by an authenticated client to disclosure certain memory content of the server process.

2) A boundary error within the handling of specially crafted invalid COM_TABLE_DUMP packets can be exploited by an authenticated client to cause a buffer overflow and allows arbitrary code execution.

3) An error within the handling of malformed login packets can be exploited to disclosure certain memory content of the server process in the error messages.

Stefano Di Paola reports :

An authenticated user could remotely execute arbitrary commands by taking advantage of a stack overflow.

To take advantage of these flaws an attacker should have direct access to MySQL server communication layer (port 3306 or unix socket). But if used in conjuction with some web application flaws (i.e. php code injection) an attacker could use socket programming (i.e. php sockets) to gain access to that layer.

New mysql packages are available for Slackware 10.2 and -current to fix security issues. The MySQL package shipped with Slackware 10.2 may possibly leak sensitive information found in uninitialized memory to authenticated users. The MySQL package previously in Slackware
-current also suffered from these flaws, but an additional overflow could allow arbitrary code execution. Since the vulnerabilities require a valid login and/or access to the database server, the risk is moderate. Slackware does not provide network access to a MySQL database by default.

According to its version number, the installation of MySQL on the remote host may be prone to multiple buffer overflows.  The MySQL server is also vulnerable to multiple information disclosure flaws.  An attacker exploiting the overflow would need to be able to authenticate to the MySQL server.  An attacker exploiting the information disclosure flaw would only need to be able to send malformed 'login' packets to the server. This version of MySQL is also prone to a remote Denial of Service (DoS) due to an inability to properly parse a malformed call to the date_format function.

ID	Name	Product	Family	Severity
17697	MySQL < 4.0.27 / 4.1.19 / 5.0.21 Multiple Vulnerabilities	Nessus	Databases	medium
27881	Ubuntu 5.10 : mysql-dfsg-4.1 vulnerability (USN-306-1)	Nessus	Ubuntu Local Security Checks	medium
27356	openSUSE 10 Security Update : mysql (mysql-1312)	Nessus	SuSE Local Security Checks	medium
3947	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus Network Monitor	Web Clients	high
22621	Debian DSA-1079-1 : mysql-dfsg - several vulnerabilities	Nessus	Debian Local Security Checks	medium
22615	Debian DSA-1073-1 : mysql-dfsg-4.1 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
22613	Debian DSA-1071-1 : mysql - several vulnerabilities	Nessus	Debian Local Security Checks	medium
21633	FreeBSD : MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities (4913886c-e875-11da-b9f4-00123ffe8333)	Nessus	FreeBSD Local Security Checks	medium
21492	FreeBSD : mysql50-server -- COM_TABLE_DUMP arbitrary code execution (a8d8713e-dc83-11da-a22b-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	medium
21345	Slackware 10.2 / current : mysql (SSA:2006-129-02)	Nessus	Slackware Local Security Checks	medium
3527	Oracle MySQL Remote Overflow and Information Disclosure Vulnerabilities	Nessus Network Monitor	Database	medium
801163	MySQL Remote Overflow and Information Disclosure Vulnerabilities	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2006-1518

critical

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium