CVE-2009-2446: High severity mysql vulnerability

Published Jul 13, 2009

Updated

Multiple format string vulnerabilities in the dispatchcommand function in libmysqld/sqlparse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COMCREATEDB or (2) COMDROPDB request. NOTE: some of these details are obtained from third party information.

Affected Software

115 affected components

MySQL mysql=5.0.5

MySQL mysql=5.0.10

MySQL mysql=4.1.23

MySQL mysql=5.0.54

MySQL mysql=5.0.0

MySQL mysql=5.0.15

MySQL mysql=5.0.17

MySQL mysql=4.1.13

MySQL mysql=5.0.5.0.21

MySQL mysql=5.0.3

MySQL mysql=4.1.15

MySQL mysql=4.1.8

MySQL mysql=5.0.44

MySQL mysql=5.0.66

MySQL mysql=4.1.14

MySQL mysql=5.0.56

MySQL mysql=4.1.12

MySQL mysql=4.1.10

MySQL mysql=5.0.60

MySQL mysql=5.0.24

MySQL mysql=5.0.2

MySQL mysql=5.0.22.1.0.1

MySQL mysql=5.0.30

MySQL mysql=5.0.20

MySQL mysql=5.0.1

MySQL mysql=4.1.0

MySQL mysql=5.0.4

MySQL mysql=4.1.3

MySQL mysql=5.0.82

MySQL mysql=5.0.36

MySQL mysql=5.0.16

MySQL mysql=4.1.2

Oracle MySQL=4.0.0

Oracle MySQL=4.0.1

Oracle MySQL=4.0.2

Oracle MySQL=4.0.3

Oracle MySQL=4.0.4

Oracle MySQL=4.0.5

Oracle MySQL=4.0.5a

Oracle MySQL=4.0.6

Oracle MySQL=4.0.7

Oracle MySQL=4.0.7-gamma

Oracle MySQL=4.0.8-gamma

Oracle MySQL=4.0.8

Oracle MySQL=4.0.9

Oracle MySQL=4.0.9-gamma

Oracle MySQL=4.0.10

Oracle MySQL=4.0.11-gamma

Oracle MySQL=4.0.11

Oracle MySQL=4.0.12

Oracle MySQL=4.0.13

Oracle MySQL=4.0.14

Oracle MySQL=4.0.15

Oracle MySQL=4.0.16

Oracle MySQL=4.0.17

Oracle MySQL=4.0.18

Oracle MySQL=4.0.19

Oracle MySQL=5.0.50

Oracle MySQL=5.0.51

Oracle MySQL=5.0.51a

Oracle MySQL=4.0.20

Oracle MySQL=4.0.21

Oracle MySQL=4.0.23

Oracle MySQL=4.0.24

Oracle MySQL=4.0.25

Oracle MySQL=4.0.26

Oracle MySQL=4.0.27

Oracle MySQL=4.1.0-alpha

Oracle MySQL=4.1.1

Oracle MySQL=4.1.2-alpha

Oracle MySQL=4.1.3-beta

Oracle MySQL=4.1.4

Oracle MySQL=4.1.5

Oracle MySQL=4.1.6

Oracle MySQL=4.1.7

Oracle MySQL=4.1.9

Oracle MySQL=4.1.11

Oracle MySQL=4.1.16

Oracle MySQL=4.1.17

Oracle MySQL=4.1.18

Oracle MySQL=4.1.19

Oracle MySQL=4.1.20

Oracle MySQL=4.1.21

Oracle MySQL=4.1.22

Oracle MySQL=5.0.0-alpha

Oracle MySQL=5.0.3-beta

Oracle MySQL=5.0.6

Oracle MySQL=5.0.11

Oracle MySQL=5.0.12

Oracle MySQL=5.0.13

Oracle MySQL=5.0.14

Oracle MySQL=5.0.18

Oracle MySQL=5.0.19

Oracle MySQL=5.0.21

Oracle MySQL=5.0.22

Oracle MySQL=5.0.23

Oracle MySQL=5.0.25

Oracle MySQL=5.0.26

Oracle MySQL=5.0.27

Oracle MySQL=5.0.30-sp1

Oracle MySQL=5.0.32

Oracle MySQL=5.0.33

Oracle MySQL=5.0.37

Oracle MySQL=5.0.38

Oracle MySQL=5.0.41

Oracle MySQL=5.0.42

Oracle MySQL=5.0.45

Oracle MySQL=5.0.52

Oracle MySQL=5.0.7

Oracle MySQL=5.0.8

Oracle MySQL=5.0.75

Oracle MySQL=5.0.77

Oracle MySQL=5.0.81

Oracle MySQL=5.0.9

Oracle MySQL=5.0.83

Remediation

Patch Available

http://www.osvdb.org/55734

Event History

Jul 13, 2009

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-2446?

CVE-2009-2446 has a severity level that allows remote authenticated users to potentially cause a denial of service by exploiting format string vulnerabilities.

How do I fix CVE-2009-2446?

To fix CVE-2009-2446, update MySQL to a patched version that addresses the format string vulnerabilities.

Which versions of MySQL are affected by CVE-2009-2446?

CVE-2009-2446 affects MySQL versions from 4.0.0 to 5.0.83.

What type of vulnerability is CVE-2009-2446?

CVE-2009-2446 is classified as a multiple format string vulnerability.

Can CVE-2009-2446 lead to unauthorized access?

While CVE-2009-2446 primarily poses a denial of service risk, it may lead to unspecified other impacts as well.