Login Request a demo
Unscored severity · published Aug 30, 2006
CVE-2006-4305
Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client
–
CVSS
71.7%
EPSS
No
On KEV
Description
Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client.
Exploitation
Is it being used?
Exploit prediction (EPSS)71.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Maxdb · Mysql
through 7.6.00.22 · source: NVD
SA
Sap-db · Sap-db
All versions, or not specified · source: NVD
Affected product
MA
Maxdb
Mysql
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4305
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4305
dev.mysql.com
http://dev.mysql.com/doc/maxdb/changes/changes_7.6.00.32.html
Vendor Advisory
http://secunia.com/advisories/21677
Vendor Advisory
http://secunia.com/advisories/22518
Vendor Advisory
http://securitytracker.com/id?1016766
Patch
http://www.debian.org/security/2006/dsa-1190
www.securityfocus.com
http://www.securityfocus.com/archive/1/444601/100/0/threaded
More from Maxdb
–
CVE-2005-0083
MySQL MaxDB 7.5.00 for Windows, and possibly earlier versions and other platforms, allows remote attackers to cause a denial of service (application crash) via invalid parameters…
–
CVE-2005-1274
Stack-based buffer overflow in the getIfHeader function in the WebDAV functionality in MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via an HTTP…
–
CVE-2005-0684
Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long file parameter…
–
CVE-2005-0082
The sapdbwa_GetUserData function in MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via invalid parameters to…
–
CVE-2005-0081
MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via an HTTP request with invalid headers