SQL injection in mysql - CVE-2009-5026
Published: August 17, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU43713
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2009-5026
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: Google
Affected software:
mysql
mysql
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
How to mitigate CVE-2009-5026
Install update from vendor's website.
Sources
- http://bugs.mysql.com/bug.php?id=49124
- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-93.html
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-50.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html
- http://seclists.org/oss-sec/2011/q4/101
- http://secunia.com/advisories/49179
- https://bugzilla.redhat.com/show_bug.cgi?id=640177