MySQL before 4.0.20 allows remote attackers to cause a denial of service (application crash) via a MATCH AGAINST query with an opening double quote but no closing double quote.

Several vulnerabilities have been discovered in the MySQL database server.

Lukasz Wojtow discovered a potential buffer overflow in the function mysql_real_connect(). A malicious name server could send specially crafted DNS packages which might result in execution of arbitrary code with the database server's privileges. However, it is believed that this bug cannot be exploited with the C Standard library (glibc) that Ubuntu uses. (CAN-2004-0836).

Dean Ellis noticed a flaw that allows an authorized MySQL user to cause a denial of service (crash or hang) via concurrent execution of certain statements (ALTER TABLE ... UNION=, FLUSH TABLES) on tables of type MERGE (CAN-2004-0837)

Some query strings containing a double quote (like MATCH ... AGAINST (' some ' query' IN BOOLEAN MODE) ) that did not have a matching closing double quote caused a denial of service (server crash). Again, this is only exploitable by authorized mysql users. (CAN-2004-0956)

If a user was granted privileges to a database with a name containing an underscore ('_'), the user also gained the ability to grant privileges to other databases with similar names. (CAN-2004-0957).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A special crafted MySQL FTS request can cause the server to crash.
Malicious MySQL users can abuse this bug in a denial of service attack against systems running an affected MySQL daemon.

Note that because this bug is related to the parsing of requests, it may happen that this bug is triggered accidentally by a user when he or she makes a typo.

The remote host is running a version of MySQL that is older than version 4.0.21.
It is vulnerable to a flaw that may allow an attacker to cause a Denial Of Service. An attacker can exploit this vulnerability by using the FULLTEXT search functionality. 

You are running a version of MySQL which is older than version 4.0.21.
Such versions are potentially affected by two flaws :

  - There is an unauthorized database GRANT privilege     vulnerability, which may allow an attacker to misuse the     GRANT privilege it has been given and to use it against     other databases. (CVE-2004-0957)

  - A denial of service vulnerability may be triggered by     the misuse of the FULLTEXT search functionality.
    (CVE-2004-0956)

The remote host is running a version of MySQL that is older than version 4.0.21.
It is vulnerable to a flaw that may allow an attacker to cause a Denial Of Service. An attacker can exploit this vulnerability by using the FULLTEXT search functionality.

ID	Name	Product	Family	Severity
20648	Ubuntu 4.10 : mysql-dfsg vulnerabilities (USN-32-1)	Nessus	Ubuntu Local Security Checks	critical
18882	FreeBSD : mysql -- FTS request denial of service vulnerability (29edd807-438d-11d9-8bb9-00065be4b5b6)	Nessus	FreeBSD Local Security Checks	medium
2369	Oracle MySQL < 4.0.21 Remote FULLTEXT Search DoS	Nessus Network Monitor	Database	medium
15477	MySQL < 4.0.21 Multiple Vulnerabilities	Nessus	Databases	medium
801166	MySQL < 4.0.21 Remote FULLTEXT Search DoS	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2004-0956

high

Tenable Plugins

critical

medium

medium

medium

medium