CVE-2006-2753: SQL Injection

Published Jun 1, 2006

Updated

SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the mysqlrealescape function is used to escape the input.

Affected Software

42 affected components

MySQL mysql=5.0.5

MySQL mysql=5.0.10

MySQL mysql=5.0.0

MySQL mysql=5.0.15

MySQL mysql=5.0.17

MySQL mysql=4.1.13

MySQL mysql=5.0.3

MySQL mysql=4.1.15

MySQL mysql=4.1.8

MySQL mysql=4.1.14

MySQL mysql=4.1.12

MySQL mysql=4.1.10

MySQL mysql=5.0.2

MySQL mysql=5.0.20

MySQL mysql=5.0.1

MySQL mysql=4.1.0

MySQL mysql=5.0.4

MySQL mysql=4.1.3

MySQL mysql=5.0.16

MySQL mysql=4.1.2

Oracle MySQL=4.1.1

Oracle MySQL=4.1.4

Oracle MySQL=4.1.5

Oracle MySQL=4.1.6

Oracle MySQL=4.1.7

Oracle MySQL=4.1.9

Oracle MySQL=4.1.11

Oracle MySQL=4.1.16

Oracle MySQL=4.1.17

Oracle MySQL=4.1.18

Oracle MySQL=4.1.19

Oracle MySQL=5.0.6

Oracle MySQL=5.0.11

Oracle MySQL=5.0.12

Oracle MySQL=5.0.13

Oracle MySQL=5.0.14

Oracle MySQL=5.0.18

Oracle MySQL=5.0.19

Oracle MySQL=5.0.21

Oracle MySQL=5.0.7

Oracle MySQL=5.0.8

Oracle MySQL=5.0.9

Remediation

Patch Available

http://lists.mysql.com/announce/364

Event History

Jun 1, 2006

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-2753?

CVE-2006-2753 is considered a critical severity vulnerability due to its potential for allowing attackers to execute arbitrary SQL commands.

How do I fix CVE-2006-2753?

To fix CVE-2006-2753, upgrade your MySQL installation to version 4.1.20 or higher for 4.1.x, or 5.0.22 or higher for 5.0.x.

What types of databases are affected by CVE-2006-2753?

CVE-2006-2753 affects MySQL versions 4.1.x before 4.1.20 and 5.0.x before 5.0.22.

What types of attacks can be executed using CVE-2006-2753?

CVE-2006-2753 allows context-dependent attackers to execute arbitrary SQL commands through crafted multibyte encodings.

What is the nature of the vulnerability described in CVE-2006-2753?

CVE-2006-2753 is a SQL injection vulnerability caused by improper handling of multibyte character encodings.