5

CVE-2005-2573

The mysql_create_function function in sql_udf.cc for MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta, when running on Windows, uses an incomplete blacklist in a directory traversal check, which allows attackers to include arbitrary files via the backslash (\) character.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mysql ≫ Mysql Version 4.1.0
Mysql ≫ Mysql Version 4.1.3
Mysql ≫ Mysql Version 4.1.10
Mysql ≫ Mysql Version 5.0.1
Mysql ≫ Mysql Version 5.0.2
Mysql ≫ Mysql Version 5.0.3
Mysql ≫ Mysql Version 5.0.4
Oracle ≫ Mysql Version 4.0.0
Oracle ≫ Mysql Version 4.0.1
Oracle ≫ Mysql Version 4.0.2
Oracle ≫ Mysql Version 4.0.3
Oracle ≫ Mysql Version 4.0.4
Oracle ≫ Mysql Version 4.0.5
Oracle ≫ Mysql Version 4.0.5a
Oracle ≫ Mysql Version 4.0.6
Oracle ≫ Mysql Version 4.0.7
Oracle ≫ Mysql Version 4.0.7 Update gamma
Oracle ≫ Mysql Version 4.0.8
Oracle ≫ Mysql Version 4.0.8 Update gamma
Oracle ≫ Mysql Version 4.0.9
Oracle ≫ Mysql Version 4.0.9 Update gamma
Oracle ≫ Mysql Version 4.0.10
Oracle ≫ Mysql Version 4.0.11
Oracle ≫ Mysql Version 4.0.11 Update gamma
Oracle ≫ Mysql Version 4.0.12
Oracle ≫ Mysql Version 4.0.13
Oracle ≫ Mysql Version 4.0.14
Oracle ≫ Mysql Version 4.0.15
Oracle ≫ Mysql Version 4.0.18
Oracle ≫ Mysql Version 4.0.20
Oracle ≫ Mysql Version 4.0.21
Oracle ≫ Mysql Version 4.0.24
Oracle ≫ Mysql Version 4.1.0 Update alpha
Oracle ≫ Mysql Version 4.1.2 Update alpha
Oracle ≫ Mysql Version 4.1.3 Update beta
Oracle ≫ Mysql Version 4.1.4
Oracle ≫ Mysql Version 4.1.5
Oracle ≫ Mysql Version 5.0.0 Update alpha
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.81% 0.847
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.grok.org.uk/pipermail/full-disclosure/2005-August/035847.html
Patch
Vendor Advisory
http://marc.info/?l=bugtraq&m=112360618320729&w=2
http://mysql.bkbits.net:8080/mysql-4.0/cset%40428b981bg2iwh3CbGANDaF-W6DbttA
http://mysql.bkbits.net:8080/mysql-4.0/gnupatch%40428b981bg2iwh3CbGANDaF-W6DbttA
http://www.appsecinc.com/resources/alerts/mysql/2005-001.html
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/21738