Detections
Analytics
MySQL Anonymous Login Handshake Remote Information Disclosure
medium Nessus Plugin ID 21632
Language:
Synopsis
The remote database server is affected by an information disclosure flaw.Description
The MySQL database server on the remote host reads from uninitialized memory when processing a specially crafted login packet. An unauthenticated attacker may be able to exploit this flaw to obtain sensitive information from the affected host as returned in an error packet.Solution
Upgrade to MySQL 4.0.27 / 4.1.19 / 5.0.21 / 5.1.10 or later.See Also
https://www.securityfocus.com/archive/1/432733/30/0/threaded
http://dev.mysql.com/doc/refman/4.1/en/news-4-0-27.html
http://dev.mysql.com/doc/refman/4.1/en/news-4-1-19.html
Plugin Details
Severity: Medium
ID: 21632
File Name: mysql_anonymous_login_handshake_info_leakage.nasl
Version: 1.21
Type: remote
Family: Databases
Published: 6/4/2006
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.5
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
CPE: cpe:/a:mysql:mysql
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 5/2/2006
Reference Information
CVE: CVE-2006-1516
BID: 17780