medium6.8Public exploit code
CVE-2009-5026
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Oracle MySQL < 5.1.50 - Privilege Escalation2010-08-03 · remote · multiple · Verified
Impact
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mysql | Mysql | Versions 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5 |
| Oracle | Mysql | Versions 5.0.23, 5.0.41, 5.0.45, 5.0.51, 5.0.67, 5.0.75 |
Weakness classification
References
- NVD record
- CVE.org record
- http://bugs.mysql.com/bug.php?id=49124
- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-93.html
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-50.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html
- http://seclists.org/oss-sec/2011/q4/101
- http://secunia.com/advisories/49179
- https://bugzilla.redhat.com/show_bug.cgi?id=640177
- http://bugs.mysql.com/bug.php?id=49124
- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-93.html
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-50.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html
- http://seclists.org/oss-sec/2011/q4/101
- http://secunia.com/advisories/49179
- https://bugzilla.redhat.com/show_bug.cgi?id=640177