CVE-2005-0684
Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long file parameter after a percent ("%") sign or (2) a long Lock-Token string to the WebDAV…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 68.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long file parameter after a percent ("%") sign or (2) a long Lock-Token string to the WebDAV functionality, which is not properly handled by the getLockTokenHeader function in WDVHandler_CommonUtils.c.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 68.50% probability · 99th percentile
- CISA KEV
- Not listed
- Affected
- mysql/maxdb
- Source
- cve@mitre.org
References
- http://dev.mysql.com/doc/maxdb/changes/changes_7.5.00.26.html#WebDAVPatch, Vendor Advisory
- http://www.idefense.com/application/poi/display?id=234&type=vulnerabilitiesPatch, Vendor Advisory
- http://www.idefense.com/application/poi/display?id=235&type=vulnerabilitiesPatch, Vendor Advisory
- http://www.securityfocus.com/bid/13368
- http://dev.mysql.com/doc/maxdb/changes/changes_7.5.00.26.html#WebDAVPatch, Vendor Advisory
- http://www.idefense.com/application/poi/display?id=234&type=vulnerabilitiesPatch, Vendor Advisory
- http://www.idefense.com/application/poi/display?id=235&type=vulnerabilitiesPatch, Vendor Advisory
- http://www.securityfocus.com/bid/13368
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.