ZDI-CAN-13551: MySQL InnoDB Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of MySQL. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of InnoDB commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-13551?
The severity of ZDI-CAN-13551 is critical due to its potential to allow remote code execution without authentication.
How do I fix ZDI-CAN-13551?
To fix ZDI-CAN-13551, update to the latest version of MySQL that addresses this vulnerability.
Who is affected by ZDI-CAN-13551?
Affected users are those utilizing unpatched installations of MySQL that process InnoDB commands.
Can ZDI-CAN-13551 be exploited remotely?
Yes, ZDI-CAN-13551 can be exploited remotely by attackers without requiring authentication.
What causes the ZDI-CAN-13551 vulnerability?
ZDI-CAN-13551 is caused by inadequate validation in the processing of InnoDB commands.