PUBLISHED DATE: December 23, 2002CVE-2002-1376:
Denial of Service Vulnerability

Description

libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Products

• Oracle MySQL 3.22.26
• Oracle MySQL 3.22.27
• Oracle MySQL 3.22.28
• Oracle MySQL 3.22.29
• Oracle MySQL 3.22.30
• Oracle MySQL 3.22.32
• Oracle MySQL 3.23.10
• Oracle MySQL 3.23.23
• Oracle MySQL 3.23.24
• Oracle MySQL 3.23.25
• Oracle MySQL 3.23.26
• Oracle MySQL 3.23.27
• Oracle MySQL 3.23.28
• Oracle MySQL 3.23.28 Gamma
• Oracle MySQL 3.23.29
• Oracle MySQL 3.23.2
• Oracle MySQL 3.23.30
• Oracle MySQL 3.23.31
• Oracle MySQL 3.23.34
• Oracle MySQL 3.23.36
• Oracle MySQL 3.23.37
• Oracle MySQL 3.23.38
• Oracle MySQL 3.23.39
• Oracle MySQL 3.23.3
• Oracle MySQL 3.23.40
• Oracle MySQL 3.23.41
• Oracle MySQL 3.23.42
• Oracle MySQL 3.23.43
• Oracle MySQL 3.23.44
• Oracle MySQL 3.23.45
• Oracle MySQL 3.23.46
• Oracle MySQL 3.23.47
• Oracle MySQL 3.23.48
• Oracle MySQL 3.23.49
• Oracle MySQL 3.23.4
• Oracle MySQL 3.23.50
• Oracle MySQL 3.23.51
• Oracle MySQL 3.23.52
• Oracle MySQL 3.23.53
• Oracle MySQL 3.23.53a
• Oracle MySQL 3.23.5
• Oracle MySQL 3.23.8
• Oracle MySQL 3.23.9
• Oracle MySQL 4.0.0
• Oracle MySQL 4.0.1
• Oracle MySQL 4.0.2
• Oracle MySQL 4.0.3
• Oracle MySQL 4.0.5a
• Symantec Veritas NetBackup Advanced Reporter 3.4
• Symantec Veritas NetBackup Advanced Reporter 4.5
• Symantec Veritas NetBackup Advanced Reporter 4.5 FP1
• Symantec Veritas NetBackup Advanced Reporter 4.5 FP2
• Symantec Veritas NetBackup Advanced Reporter 4.5 FP3
• Symantec Veritas NetBackup Advanced Reporter 4.5 MP1
• Symantec Veritas NetBackup Advanced Reporter 4.5 MP2
• Symantec Veritas NetBackup Advanced Reporter 4.5 MP3
• Symantec Veritas NetBackup Global Data Manager 4.5
• Symantec Veritas NetBackup Global Data Manager 4.5 FP1
• Symantec Veritas NetBackup Global Data Manager 4.5 FP2
• Symantec Veritas NetBackup Global Data Manager 4.5 FP3
• Symantec Veritas NetBackup Global Data Manager 4.5 MP1
• Symantec Veritas NetBackup Global Data Manager 4.5 MP2
• Symantec Veritas NetBackup Global Data Manager 4.5 MP3

Questions to Ask Vendors

1. Can you confirm whether your systems are affected by CVE-2002-1376, and if so, what steps are you currently taking to mitigate this vulnerability?
2. What is your estimated timeline for fully resolving CVE-2002-1376 in your products or services, and how will you communicate updates on this issue to us as your customer?

Recommended Actions

• Check out the advisory links provided below.

References

• https://nvd.nist.gov/vuln/detail/CVE-2002-1376