CVE-2009-3102: Input Validation
Published Sep 8, 2009
·Updated
The doHotCopy subroutine in socket-server.pl in Zmanda Recovery Manager (ZRM) for MySQL 2.x before 2.1.1 allows remote attackers to execute arbitrary commands via vectors involving a crafted $MYSQLBINPATH variable.
Affected Software
1 affected component
Zmanda Zrm For My Sql=2.1
Event History
Sep 8, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-3102?
CVE-2009-3102 is rated as high severity due to its ability to allow remote command execution.
2
How do I fix CVE-2009-3102?
To fix CVE-2009-3102, upgrade Zmanda Recovery Manager for MySQL to version 2.1.1 or later.
3
What types of attacks can be executed through CVE-2009-3102?
CVE-2009-3102 allows attackers to execute arbitrary commands on the affected server.
4
Which versions of Zmanda Recovery Manager are affected by CVE-2009-3102?
Zmanda Recovery Manager for MySQL version 2.1 and earlier are affected by CVE-2009-3102.
5
Is CVE-2009-3102 exploitable remotely?
Yes, CVE-2009-3102 can be exploited remotely by attackers with crafted input.