Vulnerability in Mysql
CVE-2009-2446
Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained from third party information.
EPSS: 0.106 (95.3th percentile) — read the EPSS interpretation.
Affected products
- Mysql — versions 4.1.0, 4.1.2, 4.1.3
- Oracle Mysql — versions 4.0.0, 4.0.1, 4.0.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory)
- cve@mitre.org (mailing-list, Exploit, x_refsource_FULLDISC)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (vendor-advisory, x_refsource_APPLE)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_OSVDB, Patch, vdb-entry)
- cve@mitre.org (signature, x_refsource_OVAL, vdb-entry)
Frequently asked questions
- What is CVE-2009-2446?
- CVE-2009-2446 is a vulnerability in Mysql, classified under Use of Externally-Controlled Format String. Published 2009-07-13.
- Is CVE-2009-2446 known to be exploited?
- 14 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.