Vulnerability Details : CVE-2008-3963
MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2008-3963
- cpe:2.3:a:oracle:mysql:5.0.33:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.0:alpha:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.41:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.32:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.16:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.17:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:6.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:6.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.51:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.52:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.18:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.19:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.20:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.25:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.26:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.42:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.45:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.23:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.22:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.30:sp1:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.38:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.50:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.21:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.5.0.21:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.22.1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.30:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.36:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.44:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.60:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.54:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.56:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.1.23:*:*:*:*:*:*:*
Threat overview for CVE-2008-3963
Top countries where our scanners detected CVE-2008-3963
Top open port discovered on systems with this issue
3306
IPs affected by CVE-2008-3963 9,374
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2008-3963!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2008-3963
4.95%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-3963
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:P |
8.0
|
2.9
|
NIST |
CWE ids for CVE-2008-3963
-
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2008-3963
-
Red Hat 2009-09-02This issue did not affect MySQL as supplied with Red Hat Enterprise Linux 3 or 4. This issue was addressed for Red Hat Enterprise Linux 5 and Red Hat Application Stack v2 https://rhn.redhat.com/cve/CVE-2008-3963.html
References for CVE-2008-3963
-
http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html
-
http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html
-
http://www.ubuntu.com/usn/USN-671-1
-
http://bugs.mysql.com/bug.php?id=35658
-
http://www.openwall.com/lists/oss-security/2008/09/09/4
-
https://bugs.gentoo.org/237166
-
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2008:025 - openSUSE Security Announce - openSUSE Mailing Lists
-
http://www.redhat.com/support/errata/RHSA-2009-1067.html
Support
-
http://www.debian.org/security/2009/dsa-1783
Patch
-
http://www.securitytracker.com/id?1020858
-
http://www.ubuntu.com/usn/USN-1397-1
USN-1397-1: MySQL vulnerabilities | Ubuntu security notices
-
http://www.openwall.com/lists/oss-security/2008/09/09/7
-
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html
-
http://www.vupen.com/english/advisories/2008/2554
Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/45042
-
http://www.redhat.com/support/errata/RHSA-2009-1289.html
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10521
-
http://www.mandriva.com/security/advisories?name=MDVSA-2009:094
Jump to