CVE-2006-3469: Medium severity MySQL mysql vulnerability

Published Jul 19, 2006

Updated

Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the dateformat function, which is later used in a formatted print call to display the error message.

Affected Software

25 affected components

MySQL mysql=4.1.8

MySQL mysql=4.1.12

MySQL mysql=4.1.13

MySQL mysql=4.1.14

MySQL mysql=4.1.15

MySQL mysql=5.0.5.0.21

MySQL mysql=5.0.10

MySQL mysql=5.0.15

MySQL mysql=5.0.16

MySQL mysql=5.0.17

Oracle MySQL=4.1.6

Oracle MySQL=4.1.7

Oracle MySQL=4.1.9

Oracle MySQL=4.1.11

Oracle MySQL=4.1.16

Oracle MySQL=4.1.18

Oracle MySQL=4.1.19

Oracle MySQL=4.1.20

Oracle MySQL=5.0.6

Oracle MySQL=5.0.9

Oracle MySQL=5.0.11

Oracle MySQL=5.0.12

Oracle MySQL=5.0.13

Oracle MySQL=5.0.18

Oracle MySQL=5.0.19

Remediation

Patch Available

http://www.debian.org/security/2006/dsa-1112

Event History

Jul 19, 2006

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3469?

CVE-2006-3469 is considered a moderate severity vulnerability as it can lead to a denial of service due to a crash.

How do I fix CVE-2006-3469?

To fix CVE-2006-3469, upgrade MySQL Server to version 4.1.21 or later on the 4.1 branch, or version 5.0 after the 1st of April 2006.

What software versions are affected by CVE-2006-3469?

CVE-2006-3469 affects MySQL Server versions 4.1.6 to 4.1.20 and 5.0 up to 5.0.16.

What type of attack can CVE-2006-3469 facilitate?

CVE-2006-3469 can facilitate a denial of service attack by causing the MySQL server to crash when the date_format function is misused.

Who can exploit CVE-2006-3469?

CVE-2006-3469 can be exploited by remote authenticated users who send inappropriate format strings as input.