CVE-2006-0903: Medium severity MySQL mysql vulnerability

Published Feb 27, 2006

Updated

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysqlrealquery function. NOTE: this issue was originally reported for the mysqlquery function, but the vendor states that since mysqlquery expects a null character, this is not an issue for mysqlquery.

Affected Software

133 affected components

MySQL mysql=4.1.0

MySQL mysql=4.1.3

MySQL mysql=4.1.8

MySQL mysql=4.1.10

MySQL mysql=4.1.12

MySQL mysql=4.1.13

MySQL mysql=4.1.14

MySQL mysql=4.1.15

MySQL mysql=5.0.1

MySQL mysql=5.0.2

MySQL mysql=5.0.4

MySQL mysql=5.0.5

MySQL mysql=5.0.10

MySQL mysql=5.0.15

MySQL mysql=5.0.16

MySQL mysql=5.0.17

Oracle MySQL=3.23

Oracle MySQL=3.23.0-alpha

Oracle MySQL=3.23.1

Oracle MySQL=3.23.2

Oracle MySQL=3.23.3

Oracle MySQL=3.23.4

Oracle MySQL=3.23.5

Oracle MySQL=3.23.6

Oracle MySQL=3.23.7

Oracle MySQL=3.23.8

Oracle MySQL=3.23.9

Oracle MySQL=3.23.10

Oracle MySQL=3.23.11

Oracle MySQL=3.23.12

Oracle MySQL=3.23.13

Oracle MySQL=3.23.14

Oracle MySQL=3.23.15

Oracle MySQL=3.23.16

Oracle MySQL=3.23.17

Oracle MySQL=3.23.18

Oracle MySQL=3.23.19

Oracle MySQL=3.23.20-beta

Oracle MySQL=3.23.21

Oracle MySQL=3.23.22

Oracle MySQL=3.23.23

Oracle MySQL=3.23.24

Oracle MySQL=3.23.25

Oracle MySQL=3.23.26

Oracle MySQL=3.23.27

Oracle MySQL=3.23.28-gamma

Oracle MySQL=3.23.29

Oracle MySQL=3.23.30

Oracle MySQL=3.23.31

Oracle MySQL=3.23.32

Oracle MySQL=3.23.33

Oracle MySQL=3.23.34

Oracle MySQL=3.23.35

Oracle MySQL=3.23.36

Oracle MySQL=3.23.37

Oracle MySQL=3.23.38

Oracle MySQL=3.23.39

Oracle MySQL=3.23.40

Oracle MySQL=3.23.41

Oracle MySQL=3.23.42

Oracle MySQL=3.23.43

Oracle MySQL=3.23.44

Oracle MySQL=3.23.45

Oracle MySQL=3.23.46

Oracle MySQL=3.23.47

Oracle MySQL=3.23.48

Oracle MySQL=3.23.49

Oracle MySQL=3.23.50

Oracle MySQL=3.23.51

Oracle MySQL=3.23.52

Oracle MySQL=3.23.53

Oracle MySQL=3.23.54

Oracle MySQL=3.23.55

Oracle MySQL=3.23.56

Oracle MySQL=3.23.57

Oracle MySQL=3.23.58

Oracle MySQL=3.23.59

Oracle MySQL=4.0.0

Oracle MySQL=4.0.1

Oracle MySQL=4.0.2

Oracle MySQL=4.0.3

Oracle MySQL=4.0.4

Oracle MySQL=4.0.5

Oracle MySQL=4.0.5a

Oracle MySQL=4.0.6

Oracle MySQL=4.0.7

Oracle MySQL=4.0.7-gamma

Oracle MySQL=4.0.8

Oracle MySQL=4.0.8-gamma

Oracle MySQL=4.0.9

Oracle MySQL=4.0.9-gamma

Oracle MySQL=4.0.10

Oracle MySQL=4.0.11

Oracle MySQL=4.0.11-gamma

Oracle MySQL=4.0.12

Oracle MySQL=4.0.13

Oracle MySQL=4.0.14

Oracle MySQL=4.0.15

Oracle MySQL=4.0.16

Oracle MySQL=4.0.17

Oracle MySQL=4.0.18

Oracle MySQL=4.0.19

Oracle MySQL=4.0.20

Oracle MySQL=4.0.21

Oracle MySQL=4.0.23

Oracle MySQL=4.0.24

Oracle MySQL=4.0.25

Oracle MySQL=4.0.26

Oracle MySQL=4.0.27

Oracle MySQL=4.1.0-alpha

Oracle MySQL=4.1.2-alpha

Oracle MySQL=4.1.3-beta

Oracle MySQL=4.1.4

Oracle MySQL=4.1.5

Oracle MySQL=4.1.6

Oracle MySQL=4.1.7

Oracle MySQL=4.1.9

Oracle MySQL=4.1.11

Oracle MySQL=4.1.16

Oracle MySQL=4.1.17

Oracle MySQL=4.1.18

Oracle MySQL=4.1.19

Oracle MySQL=5.0.0-alpha

Oracle MySQL=5.0.3-beta

Oracle MySQL=5.0.6

Oracle MySQL=5.0.7

Oracle MySQL=5.0.8

Oracle MySQL=5.0.9

Oracle MySQL=5.0.11

Oracle MySQL=5.0.12

Oracle MySQL=5.0.13

Oracle MySQL=5.0.14

Oracle MySQL=5.0.18

Event History

Feb 27, 2006

CVE Published

11:02 PM

Feb 28, 2006

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-0903?

CVE-2006-0903 is considered a low severity vulnerability as it allows local users to bypass logging mechanisms.

How do I fix CVE-2006-0903?

To fix CVE-2006-0903, upgrade to MySQL version 5.0.19 or later where the handling of NULL characters in SQL queries has been improved.

What versions are affected by CVE-2006-0903?

CVE-2006-0903 affects MySQL versions 5.0.18 and earlier, along with several earlier 4.x versions.

Can CVE-2006-0903 be exploited remotely?

CVE-2006-0903 cannot be exploited remotely as it only affects local user interactions with the MySQL server.

Who is affected by CVE-2006-0903?

Local users with access to the MySQL server can exploit CVE-2006-0903 to bypass security logging.