CVE-2004-0956
published 2005-01-10CVE-2004-0956: MySQL before 4.0.20 allows remote attackers to cause a denial of service (application crash) via a MATCH AGAINST query with an opening double quote but no…
PriorityP415medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
3.72%
88.5th percentile
MySQL before 4.0.20 allows remote attackers to cause a denial of service (application crash) via a MATCH AGAINST query with an opening double quote but no closing double quote.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| suse | suse_linux | — | — |
| suse | suse_linux | — | — |
| suse | suse_linux | — | — |
| suse | suse_linux | — | — |
| suse | suse_linux | — | — |
| suse | suse_linux | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-98qh-53vc-8522: MySQL before 4
ghsa_unreviewed·2022-04-29
CVE-2004-0956 [MEDIUM] GHSA-98qh-53vc-8522: MySQL before 4
MySQL before 4.0.20 allows remote attackers to cause a denial of service (application crash) via a MATCH AGAINST query with an opening double quote but no closing double quote.
Ubuntu
mysql vulnerabilities
vendor_ubuntu·2004-11-25
CVE-2004-0837 mysql vulnerabilities
Title: mysql vulnerabilities
Summary: mysql vulnerabilities
Several vulnerabilities have been discovered in the MySQL database
server.
Lukasz Wojtow discovered a potential buffer overflow in the function
mysql_real_connect(). A malicious name server could send specially
crafted DNS packages which might result in execution of arbitrary code
with the database server's privileges. However, it is believed that
this bug cannot be exploited with the C Standard library (glibc) that
Ubuntu uses. (CAN-2004-0836).
Dean Ellis noticed a flaw that allows an authorized MySQL user to
cause a denial of service (crash or hang) via concurrent execution of
certain statements (ALTER TABLE ... UNION=, FLUSH TABLES) on tables of
type MERGE (CAN-2004-0837)
Some query strings containing a double quote (like
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Improper Neutralization of Quoting Syntax
mitre_cwe
CWE-149 Improper Neutralization of Quoting Syntax
CWE-149: Improper Neutralization of Quoting Syntax
Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity. Impact: Unexpected State.
Potential Mitigations:
Developers should anticipate that quotes will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to
CWE
Failure to Sanitize Paired Delimiters
mitre_cwe
CWE-157 Failure to Sanitize Paired Delimiters
CWE-157: Failure to Sanitize Paired Delimiters
The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.
Paired delimiters might include: angle brackets ( and ) parentheses { and } braces [ and ] square brackets " " double quotes ' ' single quotes
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity. Impact: Unexpected State.
Potential Mitigations:
Developers should anticipate that grouping elements will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
[Implementation] Assume all input is m
http://bugs.mysql.com/bug.php?id=3870http://lists.mysql.com/packagers/202http://www.gentoo.org/security/en/glsa/glsa-200410-22.xmlhttp://www.novell.com/linux/security/advisories/2004_01_sr.htmlhttp://www.trustix.net/errata/2004/0054/https://exchange.xforce.ibmcloud.com/vulnerabilities/17768http://bugs.mysql.com/bug.php?id=3870http://lists.mysql.com/packagers/202http://www.gentoo.org/security/en/glsa/glsa-200410-22.xmlhttp://www.novell.com/linux/security/advisories/2004_01_sr.htmlhttp://www.trustix.net/errata/2004/0054/https://exchange.xforce.ibmcloud.com/vulnerabilities/17768
2005-01-10
Published