Unscored severity · published Apr 25, 2005
CVE-2005-0684
Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long file parameter…
–
CVSS
68.5%
EPSS
No
On KEV
Description
Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long file parameter after a percent ("%") sign or (2) a long Lock-Token string to the WebDAV functionality, which is not properly handled by the getLockTokenHeader function in WDVHandler_CommonUtils.c.
Exploitation
Is it being used?
Exploit prediction (EPSS)68.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Maxdb · Mysql
7.5.00; 7.5.00.08; 7.5.00.11; 7.5.00.12; 7.5.00.14; 7.5.00.15; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0684
Patch
http://dev.mysql.com/doc/maxdb/changes/changes_7.5.00.26.html#WebDAV
Patch
http://www.idefense.com/application/poi/display?id=234&type=vulnerabilities
Patch
http://www.idefense.com/application/poi/display?id=235&type=vulnerabilities
www.securityfocus.com
http://www.securityfocus.com/bid/13368
More from Maxdb
–
CVE-2006-4305
Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client
–
CVE-2005-0083
MySQL MaxDB 7.5.00 for Windows, and possibly earlier versions and other platforms, allows remote attackers to cause a denial of service (application crash) via invalid parameters…
–
CVE-2005-1274
Stack-based buffer overflow in the getIfHeader function in the WebDAV functionality in MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via an HTTP…
–
CVE-2005-0082
The sapdbwa_GetUserData function in MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via invalid parameters to…
–
CVE-2005-0081
MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via an HTTP request with invalid headers