MySQL Community Server < 5.1.47 / 5.0.91 Multiple Vulnerabilities

This script is Copyright (C) 2010-2014 Tenable Network Security, Inc.


Synopsis :

The remote database server is affected by multiple vulnerabilities.

Description :

The version of MySQL Community Server installed on the remote host is
earlier than 5.1.47 / 5.0.91 and is, therefore, potentially affected
by the following vulnerabilities :

- The server may continue reading packets indefinitely
if it receives a packet larger than the maximum size
of one packet, which could allow an unauthenticated,
remote attacker to consume a high level of CPU
and bandwidth. (Bug #50974)

- Using an overly long table name argument to the
'COM_FIELD_LIST' command, an authenticated user can
overflow a buffer and execute arbitrary code on the
affected host. (Bug #53237)

- Using a specially crafted table name argument to
'COM_FIELD_LIST', an authenticated user can bypass
almost all forms of checks for privileges and table-
level grants. (Bug #53371)

See also :

http://bugs.mysql.com/bug.php?id=50974
http://bugs.mysql.com/bug.php?id=53237
http://bugs.mysql.com/bug.php?id=53371
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-91.html
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-47.html

Solution :

Upgrade to MySQL Community Server 5.1.47 / 5.0.91 or later.

Risk factor :

Medium / CVSS Base Score : 6.5
(CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS Temporal Score : 5.1
(CVSS2#E:POC/RL:OF/RC:C)
Public Exploit Available : true

Family: Databases

Nessus Plugin ID: 46702 ()

Bugtraq ID: 40100
40106
40109

CVE ID: CVE-2010-1848
CVE-2010-1849
CVE-2010-1850