Description
Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.
Product(s):
- MySQL MySQL 4.1.0
- MySQL 4.1.0
- MySQL MySQL 4.1.0 alpha
- Oracle MySQL 3.23.10
- Oracle MySQL 3.23.22
- Oracle MySQL 3.23.23
- Oracle MySQL 3.23.24
- Oracle MySQL 3.23.25
- Oracle MySQL 3.23.26
- Oracle MySQL 3.23.27
- Oracle MySQL 3.23.28
- Oracle MySQL 3.23.28 Gamma
- Oracle MySQL 3.23.29
- Oracle MySQL 3.23.2
- Oracle MySQL 3.23.30
- Oracle MySQL 3.23.31
- Oracle MySQL 3.23.32
- Oracle MySQL 3.23.33
- Oracle MySQL 3.23.34
- Oracle MySQL 3.23.36
- Oracle MySQL 3.23.37
- Oracle MySQL 3.23.38
- Oracle MySQL 3.23.39
- Oracle MySQL 3.23.3
- Oracle MySQL 3.23.40
- Oracle MySQL 3.23.41
- Oracle MySQL 3.23.42
- Oracle MySQL 3.23.43
- Oracle MySQL 3.23.44
- Oracle MySQL 3.23.45
- Oracle MySQL 3.23.46
- Oracle MySQL 3.23.47
- Oracle MySQL 3.23.48
- Oracle MySQL 3.23.49
- Oracle MySQL 3.23.4
- Oracle MySQL 3.23.50
- Oracle MySQL 3.23.51
- Oracle MySQL 3.23.52
- Oracle MySQL 3.23.53
- Oracle MySQL 3.23.53a
- Oracle MySQL 3.23.54
- Oracle MySQL 3.23.54a
- Oracle MySQL 3.23.55
- Oracle MySQL 3.23.56
- Oracle MySQL 3.23.5
- Oracle MySQL 3.23.8
- Oracle MySQL 3.23.9
- Oracle MySQL 3.23
- Oracle MySQL 4.0.0
- Oracle MySQL 4.0.10
- Oracle MySQL 4.0.11
- Oracle MySQL 4.0.11 Gamma
- Oracle MySQL 4.0.12
- Oracle MySQL 4.0.13
- Oracle MySQL 4.0.14
- Oracle MySQL 4.0.1
- Oracle MySQL 4.0.2
- Oracle MySQL 4.0.3
- Oracle MySQL 4.0.4
- Oracle MySQL 4.0.5
- Oracle MySQL 4.0.5a
- Oracle MySQL 4.0.6
- Oracle MySQL 4.0.7
- Oracle MySQL 4.0.7 Gamma
- Oracle MySQL 4.0.8
- Oracle MySQL 4.0.8 Gamma
- Oracle MySQL 4.0.9
- Oracle MySQL 4.0.9 Gamma
- Oracle MySQL 4.1.0 Alpha
- Conectiva Conectiva Linux 7.0
- Conectiva Conectiva Linux 8.0
- Conectiva Linux 9.0
Question to Ask Vendors:
- Can you confirm whether your systems are affected by CVE-2003-0780, and if so, what steps are you currently taking to mitigate this vulnerability?
- What is your estimated timeline for fully resolving CVE-2003-0780 in your products or services, and how will you communicate updates on this issue to us as your customer?
Recommended Actions:
- Check out the advisory links provided below.