#VU43713 SQL injection in mysql - CVE-2009-5026
Published: August 17, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU43713
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2009-5026
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
mysql
mysql
Software vendor:
Google
Description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
Remediation
Install update from vendor's website.
External links
- http://bugs.mysql.com/bug.php?id=49124
- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-93.html
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-50.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html
- http://seclists.org/oss-sec/2011/q4/101
- http://secunia.com/advisories/49179
- https://bugzilla.redhat.com/show_bug.cgi?id=640177