FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

MySQL authentication bypass / buffer overflow

Affected packages
4.1	<=	mysql-server	<	4.1.3
5	<=	mysql-server	<=	5.0.0_2

Details

VuXML ID	e5e2883d-ceb9-11d8-8898-000d6111a684
Discovery	2004-07-01
Entry	2004-07-05
Modified	2004-08-28

By submitting a carefully crafted authentication packet, it is possible for an attacker to bypass password authentication in MySQL 4.1. Using a similar method, a stack buffer used in the authentication mechanism can be overflowed.

References

CERT/CC Vulnerability Note	184030
CERT/CC Vulnerability Note	645326
CVE Name	CVE-2004-0627
CVE Name	CVE-2004-0628
Message	Pine.LNX.4.44.0407080940550.9602-200000@pineapple.shacknet.nu
URL	http://dev.mysql.com/doc/mysql/en/News-4.1.3.html
URL	http://secunia.com/advisories/12020
URL	http://www.nextgenss.com/advisories/mysql-authbypass.txt
URL	http://www.osvdb.org/7475
URL	http://www.osvdb.org/7476