CVE-2014-0001: Buffer Overflow
Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string.
Other sources
The MySQL client in both MySQL and MariaDB contains a buffer overflow when reading the server version information.
This maybe exploited by connecting to a malicious/compromised db server or by a MITM and potentially allows execution of arbitrary code as the user running the client.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle MySQL client / MariaDB client (mysql/client)to a version that resolves this vulnerability.Fixed in 5.5.35
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0001?
CVE-2014-0001 is rated as a high severity vulnerability due to its potential for remote code execution and denial of service.
How do I fix CVE-2014-0001?
To fix CVE-2014-0001, you should upgrade to MySQL or MariaDB versions 5.5.35 or later.
What type of vulnerability is CVE-2014-0001?
CVE-2014-0001 is a buffer overflow vulnerability affecting the MySQL client.
Which software versions are affected by CVE-2014-0001?
CVE-2014-0001 affects Oracle MySQL versions 5.5.0 to 5.5.34 and MariaDB versions prior to 5.5.35.
Can CVE-2014-0001 be exploited remotely?
Yes, CVE-2014-0001 can be exploited remotely by sending a crafted long server version string to a vulnerable MySQL client.