Vulnerability Details : CVE-2009-4484 (1 public exploit)

Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.
Publish Date : 2009-12-30 Last Update Date : 2023-02-14

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	7.5
Confidentiality Impact	Partial (There is considerable informational disclosure.)
Integrity Impact	Partial (Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited.)
Availability Impact	Partial (There is reduced performance or interruptions in resource availability.)
Access Complexity	Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)	Denial Of ServiceExecute CodeOverflowMemory corruption
CWE ID	787

- Vendor Statements

Not vulnerable. This issue did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 3, 4, or 5. The packages use OpenSSL and not yaSSL.
Source: Redhat

- Related OVAL Definitions

Title	Definition Id	Family
CVE-2009-4484	oval:org.opensuse.security:def:20094484	unix
DSA-1997 mysql-dfsg-5.0 -- several vulnerabilities	oval:org.mitre.oval:def:6799	unix
DSA-1997-1 mysql-dfsg-5.0 - several vulnerabilities	oval:org.mitre.oval:def:20084	unix

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2009-4484

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	OS	Canonical	Ubuntu Linux	6.06	*	*	*	Version Details Vulnerabilities
2	OS	Canonical	Ubuntu Linux	8.04	*	*	*	Version Details Vulnerabilities
3	OS	Canonical	Ubuntu Linux	8.10	*	*	*	Version Details Vulnerabilities
4	OS	Canonical	Ubuntu Linux	9.04	*	*	*	Version Details Vulnerabilities
5	OS	Canonical	Ubuntu Linux	9.10	*	*	*	Version Details Vulnerabilities
6	OS	Canonical	Ubuntu Linux	10.04	*	*	*	Version Details Vulnerabilities
7	OS	Canonical	Ubuntu Linux	10.10	*	*	*	Version Details Vulnerabilities
8	OS	Canonical	Ubuntu Linux	11.04	*	*	*	Version Details Vulnerabilities
9	OS	Canonical	Ubuntu Linux	11.10	*	*	*	Version Details Vulnerabilities
10	OS	Debian	Debian Linux	4.0	*	*	*	Version Details Vulnerabilities
11	OS	Debian	Debian Linux	5.0	*	*	*	Version Details Vulnerabilities
12	OS	Debian	Debian Linux	6.0	*	*	*	Version Details Vulnerabilities
13	Application	Mariadb	Mariadb	*	*	*	*	Version Details Vulnerabilities
14	Application	Oracle	Mysql	*	*	*	*	Version Details Vulnerabilities
15	Application	Oracle	Mysql	5.0.0	Milestone2	*	*	Version Details Vulnerabilities
16	Application	Oracle	Mysql	5.0.0	Milestone1	*	*	Version Details Vulnerabilities
17	Application	Wolfssl	Yassl	*	*	*	*	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Canonical	Ubuntu Linux	9
Debian	Debian Linux	3
Mariadb	Mariadb	1
Oracle	Mysql	3
Wolfssl	Yassl	1

- References For CVE-2009-4484

http://www.ubuntu.com/usn/USN-1397-1
UBUNTU USN-1397-1

http://securitytracker.com/id?1023402
SECTRACK 1023402

http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1 CONFIRM

http://www.vupen.com/english/advisories/2010/0233
VUPEN ADV-2010-0233

Exploit! http://www.metasploit.com/modules/exploit/linux/mysql/mysql_yassl_getname

https://exchange.xforce.ibmcloud.com/vulnerabilities/55416
XF mysql-unspecified-bo(55416)

http://ubuntu.com/usn/usn-897-1
UBUNTU USN-897-1

http://secunia.com/advisories/38517
SECUNIA 38517

http://secunia.com/advisories/38573
SECUNIA 38573

http://www.debian.org/security/2010/dsa-1997
DEBIAN DSA-1997

http://www.securityfocus.com/bid/37974
BID 37974 RETIRED: yaSSL SSL Certificate Handling Remote Buffer Overflow Vulnerability Release Date:2010-01-27

http://www.yassl.com/release.html CONFIRM

http://www.securityfocus.com/bid/37943
BID 37943 MySQL with yaSSL SSL Certificate Handling Remote Stack Buffer Overflow Vulnerability Release Date:2012-03-12

http://www.osvdb.org/61956
OSVDB 61956

https://bugzilla.redhat.com/show_bug.cgi?id=555313 CONFIRM

http://isc.sans.org/diary.html?storyid=7900

http://intevydis.com/mysql_demo.html

http://www.vupen.com/english/advisories/2010/0236
VUPEN ADV-2010-0236

http://lists.mysql.com/commits/96697
MLIST [commits] 20100113 bzr commit into mysql-5.0-bugteam branch (ramil:2838) Bug#50227

http://secunia.com/advisories/38344
SECUNIA 38344

http://bugs.mysql.com/bug.php?id=50227 CONFIRM

http://dev.mysql.com/doc/refman/5.0/en/news-5-0-90.html CONFIRM

http://secunia.com/advisories/37493
SECUNIA 37493

http://intevydis.com/mysql_overflow1.py.txt

http://yassl.cvs.sourceforge.net/viewvc/yassl/yassl/taocrypt/src/asn.cpp?r1=1.13&r2=1.14 CONFIRM

http://secunia.com/advisories/38364
SECUNIA 38364

http://lists.immunitysec.com/pipermail/dailydave/2010-January/006020.html
MLIST [dailydave] 20100126 New db bugs

http://www.yassl.com/news.html#yassl199 CONFIRM

http://securitytracker.com/id?1023513
SECTRACK 1023513

http://intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.html

http://www.intevydis.com/blog/?p=106

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-43.html CONFIRM

http://archives.neohapsis.com/archives/dailydave/2010-q1/0002.html
MLIST [dailydave] 20100106 0day demos

http://www.securityfocus.com/bid/37640
BID 37640 MySQL 5.0.51a Unspecified Remote Code Execution Vulnerability Release Date:2012-03-12

http://www.intevydis.com/blog/?p=57

http://intevydis.com/vd-list.shtml

- Metasploit Modules Related To CVE-2009-4484

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)