CVE-2002-1375: High severity symantec veritas netbackup global data manager vulnerability
Published Dec 23, 2002
·Updated
The COMCHANGEUSER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long response.
Affected Software
62 affected components
ORACLE MySQL=3.22.26
ORACLE MySQL=3.22.27
ORACLE MySQL=3.22.28
ORACLE MySQL=3.22.29
ORACLE MySQL=3.22.30
ORACLE MySQL=3.22.32
ORACLE MySQL=3.23.2
ORACLE MySQL=3.23.3
ORACLE MySQL=3.23.4
ORACLE MySQL=3.23.5
ORACLE MySQL=3.23.8
ORACLE MySQL=3.23.9
ORACLE MySQL=3.23.10
ORACLE MySQL=3.23.23
ORACLE MySQL=3.23.24
ORACLE MySQL=3.23.25
ORACLE MySQL=3.23.26
ORACLE MySQL=3.23.27
ORACLE MySQL=3.23.28
ORACLE MySQL=3.23.29
ORACLE MySQL=3.23.30
ORACLE MySQL=3.23.31
ORACLE MySQL=3.23.34
ORACLE MySQL=3.23.36
ORACLE MySQL=3.23.37
ORACLE MySQL=3.23.38
ORACLE MySQL=3.23.39
ORACLE MySQL=3.23.40
ORACLE MySQL=3.23.41
ORACLE MySQL=3.23.42
ORACLE MySQL=3.23.43
ORACLE MySQL=3.23.44
ORACLE MySQL=3.23.45
ORACLE MySQL=3.23.46
ORACLE MySQL=3.23.47
ORACLE MySQL=3.23.48
ORACLE MySQL=3.23.49
ORACLE MySQL=3.23.50
ORACLE MySQL=3.23.51
ORACLE MySQL=3.23.52
ORACLE MySQL=3.23.53
ORACLE MySQL=3.23.53a
ORACLE MySQL=4.0.0
ORACLE MySQL=4.0.1
ORACLE MySQL=4.0.2
ORACLE MySQL=4.0.3
ORACLE MySQL=4.0.5a
Symantec Veritas Netbackup Advanced Reporter=3.4
Symantec Veritas Netbackup Advanced Reporter=4.5
Symantec Veritas Netbackup Advanced Reporter=4.5_fp1
Symantec Veritas Netbackup Advanced Reporter=4.5_fp2
Symantec Veritas Netbackup Advanced Reporter=4.5_fp3
Symantec Veritas Netbackup Advanced Reporter=4.5_mp1
Symantec Veritas Netbackup Advanced Reporter=4.5_mp2
Symantec Veritas Netbackup Advanced Reporter=4.5_mp3
Symantec Veritas Netbackup Global Data Manager=4.5
Symantec Veritas Netbackup Global Data Manager=4.5_fp1
Symantec Veritas Netbackup Global Data Manager=4.5_fp2
Symantec Veritas Netbackup Global Data Manager=4.5_fp3
Symantec Veritas Netbackup Global Data Manager=4.5_mp1
Symantec Veritas Netbackup Global Data Manager=4.5_mp2
Symantec Veritas Netbackup Global Data Manager=4.5_mp3
Remediation
Patch Available
Event History
Dec 23, 2002
CVE Published
05:00 AM
Sep 1, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2002-1375?
CVE-2002-1375 has a high severity rating as it allows remote attackers to execute arbitrary code.
2
How do I fix CVE-2002-1375?
To fix CVE-2002-1375, upgrade your MySQL to versions 3.23.54 or later, or to a more recent version if available.
3
Which versions of MySQL are affected by CVE-2002-1375?
CVE-2002-1375 affects MySQL versions 3.x before 3.23.54 and 4.x up to 4.0.6.
4
What kind of attack can exploit CVE-2002-1375?
CVE-2002-1375 can be exploited through a specially crafted COM_CHANGE_USER command that leads to arbitrary code execution.
5
Are there any workarounds for CVE-2002-1375?
As a temporary workaround for CVE-2002-1375, restricting access to the MySQL server may help mitigate risks until an upgrade can be performed.