CVE-2012-4414

Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://bugs.mysql.com/bug.php?id=66550
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00013.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00020.html
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.mysqlperformanceblog.com/2013/01/13/cve-2012-4414-in-mysql-5-5-29-and-percona-server-5-5-29/
http://www.openwall.com/lists/oss-security/2012/09/11/4
http://www.securityfocus.com/bid/55498
https://bugzilla.redhat.com/show_bug.cgi?id=852144
https://mariadb.atlassian.net/browse/MDEV-382
http://bugs.mysql.com/bug.php?id=66550
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00013.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00020.html
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.mysqlperformanceblog.com/2013/01/13/cve-2012-4414-in-mysql-5-5-29-and-percona-server-5-5-29/
http://www.openwall.com/lists/oss-security/2012/09/11/4
http://www.securityfocus.com/bid/55498
https://bugzilla.redhat.com/show_bug.cgi?id=852144
https://mariadb.atlassian.net/browse/MDEV-382

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:mysql::::::::
	cpe:2.3:a:oracle:mysql:5.1.51:::::::*
	cpe:2.3:a:oracle:mysql:5.1.52:::::::*
	cpe:2.3:a:oracle:mysql:5.1.52:sp1::::::
	cpe:2.3:a:oracle:mysql:5.1.53:::::::*
	cpe:2.3:a:oracle:mysql:5.1.54:::::::*
	cpe:2.3:a:oracle:mysql:5.1.55:::::::*
	cpe:2.3:a:oracle:mysql:5.1.56:::::::*
	cpe:2.3:a:oracle:mysql:5.1.57:::::::*
	cpe:2.3:a:oracle:mysql:5.1.58:::::::*
	cpe:2.3:a:oracle:mysql:5.1.59:::::::*
	cpe:2.3:a:oracle:mysql:5.1.60:::::::*
	cpe:2.3:a:oracle:mysql:5.1.61:::::::*
	cpe:2.3:a:oracle:mysql:5.1.62:::::::*
	cpe:2.3:a:oracle:mysql:5.1.63:::::::*
	cpe:2.3:a:oracle:mysql:5.1.64:::::::*
	cpe:2.3:a:oracle:mysql:5.1.65:::::::*
	cpe:2.3:a:oracle:mysql:5.1.66:::::::*
	cpe:2.3:a:oracle:mysql:5.1.67:::::::*
	cpe:2.3:a:oracle:mysql:5.5.10:::::::*
	cpe:2.3:a:oracle:mysql:5.5.11:::::::*
	cpe:2.3:a:oracle:mysql:5.5.12:::::::*
	cpe:2.3:a:oracle:mysql:5.5.13:::::::*
	cpe:2.3:a:oracle:mysql:5.5.14:::::::*
	cpe:2.3:a:oracle:mysql:5.5.15:::::::*
	cpe:2.3:a:oracle:mysql:5.5.16:::::::*
	cpe:2.3:a:oracle:mysql:5.5.17:::::::*
	cpe:2.3:a:oracle:mysql:5.5.18:::::::*
	cpe:2.3:a:oracle:mysql:5.5.19:::::::*
	cpe:2.3:a:oracle:mysql:5.5.20:::::::*
	cpe:2.3:a:oracle:mysql:5.5.21:::::::*
	cpe:2.3:a:oracle:mysql:5.5.22:::::::*
	cpe:2.3:a:oracle:mysql:5.5.23:::::::*
	cpe:2.3:a:oracle:mysql:5.5.24:::::::*
	cpe:2.3:a:oracle:mysql:5.5.25:::::::*
	cpe:2.3:a:oracle:mysql:5.5.25:a::::::
	cpe:2.3:a:oracle:mysql:5.5.26:::::::*
	cpe:2.3:a:oracle:mysql:5.5.27:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:mariadb:mariadb:5.1.41:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.42:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.44:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.47:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.49:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.50:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.51:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.53:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.55:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.60:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.61:::::::*
	cpe:2.3:a:mariadb:mariadb:5.1.62:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:mariadb:mariadb:5.2.0:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.1:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.2:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.3:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.4:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.5:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.6:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.7:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.8:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.9:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.10:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.11:::::::*
	cpe:2.3:a:mariadb:mariadb:5.2.12:::::::*

Configuration 4 (hide)

OR	cpe:2.3:a:mariadb:mariadb:5.3.0:::::::*
	cpe:2.3:a:mariadb:mariadb:5.3.1:::::::*
	cpe:2.3:a:mariadb:mariadb:5.3.2:::::::*
	cpe:2.3:a:mariadb:mariadb:5.3.3:::::::*
	cpe:2.3:a:mariadb:mariadb:5.3.4:::::::*
	cpe:2.3:a:mariadb:mariadb:5.3.5:::::::*
	cpe:2.3:a:mariadb:mariadb:5.3.6:::::::*
	cpe:2.3:a:mariadb:mariadb:5.3.7:::::::*

Configuration 5 (hide)

OR	cpe:2.3:a:mariadb:mariadb:5.5.20:::::::*
	cpe:2.3:a:mariadb:mariadb:5.5.21:::::::*
	cpe:2.3:a:mariadb:mariadb:5.5.22:::::::*
	cpe:2.3:a:mariadb:mariadb:5.5.23:::::::*
	cpe:2.3:a:mariadb:mariadb:5.5.24:::::::*
	cpe:2.3:a:mariadb:mariadb:5.5.25:::::::*

History

21 Nov 2024, 01:42

Type	Values Removed	Values Added
References	~~() http://bugs.mysql.com/bug.php?id=66550 -~~	() http://bugs.mysql.com/bug.php?id=66550 -
References	~~() http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.html -~~	() http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.html -
References	~~() http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.html -~~	() http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.html -
References	~~() http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00013.html -~~	() http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00013.html -
References	~~() http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00020.html -~~	() http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00020.html -
References	~~() http://www.mandriva.com/security/advisories?name=MDVSA-2013:102 -~~	() http://www.mandriva.com/security/advisories?name=MDVSA-2013:102 -
References	~~() http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 -~~	() http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 -
References	~~() http://www.mysqlperformanceblog.com/2013/01/13/cve-2012-4414-in-mysql-5-5-29-and-percona-server-5-5-29/ -~~	() http://www.mysqlperformanceblog.com/2013/01/13/cve-2012-4414-in-mysql-5-5-29-and-percona-server-5-5-29/ -
References	~~() http://www.openwall.com/lists/oss-security/2012/09/11/4 -~~	() http://www.openwall.com/lists/oss-security/2012/09/11/4 -
References	~~() http://www.securityfocus.com/bid/55498 -~~	() http://www.securityfocus.com/bid/55498 -
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=852144 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=852144 -
References	~~() https://mariadb.atlassian.net/browse/MDEV-382 -~~	() https://mariadb.atlassian.net/browse/MDEV-382 -

07 Nov 2023, 02:11

Type	Values Removed	Values Added
Summary	Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.	Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.

Information

Published : 2013-01-22 23:55

Updated : 2024-11-21 01:42

NVD link : CVE-2012-4414

Mitre link : CVE-2012-4414

CVE.ORG link : CVE-2012-4414

JSON object : View

Products Affected

oracle

mysql

mariadb

mariadb

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

6.5 /10