NetSight
IP …
medium4.0Public exploit code

CVE-2008-3963

MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string li…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.

Affected products

VendorProductAffected versions
MysqlMysql
Versions 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5
OracleMysql
Versions 5.0.0, 5.0.6, 5.0.23, 5.0.25, 5.0.26, 5.0.30

Weakness classification

CWE-134

References