CVE-2005-2573

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2005-2573
The mysql_create_function function in sql_udf.cc for MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta, when running on Windows, uses an incomplete blacklist in a directory traversal check, which allows attackers to include arbitrary files via the backslash (\) character.

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://lists.grok.org.uk/pipermail/full-disclosure/2005-August/035847.html Patch Vendor Advisory
http://marc.info/?l=bugtraq&m=112360618320729&w=2
http://mysql.bkbits.net:8080/mysql-4.0/cset%40428b981bg2iwh3CbGANDaF-W6DbttA
http://mysql.bkbits.net:8080/mysql-4.0/gnupatch%40428b981bg2iwh3CbGANDaF-W6DbttA
http://www.appsecinc.com/resources/alerts/mysql/2005-001.html Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/21738
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mysql:mysql:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:4.1.3:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:4.1.10:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.5a:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.7:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.8:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.9:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.9:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.11:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.11:gamma:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.13:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.14:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.15:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.18:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.20:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.21:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.0.24:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.1.0:alpha:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.1.2:alpha:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.1.3:beta:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.1.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:4.1.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.0.0:alpha:*:*:*:*:*:*
History

07 Nov 2023, 01:57

Type Values Removed Values Added
References
  • {'url': 'http://mysql.bkbits.net:8080/mysql-4.0/gnupatch@428b981bg2iwh3CbGANDaF-W6DbttA', 'name': 'http://mysql.bkbits.net:8080/mysql-4.0/gnupatch@428b981bg2iwh3CbGANDaF-W6DbttA', 'tags': [], 'refsource': 'CONFIRM'}
  • {'url': 'http://mysql.bkbits.net:8080/mysql-4.0/cset@428b981bg2iwh3CbGANDaF-W6DbttA', 'name': 'http://mysql.bkbits.net:8080/mysql-4.0/cset@428b981bg2iwh3CbGANDaF-W6DbttA', 'tags': [], 'refsource': 'CONFIRM'}
  • () http://mysql.bkbits.net:8080/mysql-4.0/cset%40428b981bg2iwh3CbGANDaF-W6DbttA -
  • () http://mysql.bkbits.net:8080/mysql-4.0/gnupatch%40428b981bg2iwh3CbGANDaF-W6DbttA -
Information

Published : 2005-08-16 04:00

Updated : 2023-12-10 10:28

NVD link : CVE-2005-2573

Mitre link : CVE-2005-2573

CVE.ORG link : CVE-2005-2573

JSON object : View

Products Affected

oracle

  • mysql

mysql

  • mysql
CWE
NVD-CWE-Other