漏洞描述
The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte, which causes a buffer over-read.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
secunia.comhttp://secunia.com/advisories/20625↗www.wisec.ithttp://www.wisec.it/vulns.php?page=7↗securitytracker.comhttp://securitytracker.com/id?1016017↗www.debian.orghttp://www.debian.org/security/2006/dsa-1071↗secunia.comhttp://secunia.com/advisories/20253↗secunia.comhttp://secunia.com/advisories/20073↗www.securityfocus.comhttp://www.securityfocus.com/bid/17780↗secunia.comhttp://secunia.com/advisories/20762↗www.securityfocus.comhttp://www.securityfocus.com/archive/1/432733/100/0/threaded↗lists.apple.comhttp://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html↗secunia.comhttp://secunia.com/advisories/20333↗bugs.debian.orghttp://bugs.debian.org/365938↗www.trustix.orghttp://www.trustix.org/errata/2006/0028↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/1326/references↗usn.ubuntu.comhttps://usn.ubuntu.com/283-1/↗www.debian.orghttp://www.debian.org/security/2006/dsa-1073↗secunia.comhttp://secunia.com/advisories/20076↗www.vupen.comhttp://www.vupen.com/english/advisories/2006/1633↗dev.mysql.comhttp://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html↗secunia.comhttp://secunia.com/advisories/20223↗secunia.comhttp://secunia.com/advisories/20241↗securityreason.comhttp://securityreason.com/securityalert/840↗oval.cisecurity.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9918↗www.novell.comhttp://www.novell.com/linux/security/advisories/2006-06-02.html↗docs.info.apple.comhttp://docs.info.apple.com/article.html?artnum=305214↗www.us-cert.govhttp://www.us-cert.gov/cas/techalerts/TA07-072A.html↗www.vupen.comhttp://www.vupen.com/english/advisories/2007/0930↗sunsolve.sun.comhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-236703-1↗secunia.comhttp://secunia.com/advisories/24479↗www.securityfocus.comhttp://www.securityfocus.com/archive/1/434164/100/0/threaded↗www.gentoo.orghttp://www.gentoo.org/security/en/glsa/glsa-200605-13.xml↗secunia.comhttp://secunia.com/advisories/20424↗secunia.comhttp://secunia.com/advisories/29847↗secunia.comhttp://secunia.com/advisories/19929↗secunia.comhttp://secunia.com/advisories/20002↗slackware.comhttp://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.599377↗secunia.comhttp://secunia.com/advisories/20457↗www.debian.orghttp://www.debian.org/security/2006/dsa-1079↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:084↗exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/26236↗lists.suse.comhttp://lists.suse.com/archive/suse-security-announce/2006-Jun/0011.html↗www.redhat.comhttp://www.redhat.com/support/errata/RHSA-2006-0544.html↗