CVE

Id
13779  
CVE No.
CVE-2005-2573  
Status
Candidate  
Description
The mysql_create_function function in sql_udf.cc for MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta, when running on Windows, uses an incomplete blacklist in a directory traversal check, which allows attackers to include arbitrary files via the backslash () character.  
Phase
Assigned (20050816)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
100740 13779 CVE-2005-2573 BUGTRAQ:20050808 [AppSecInc Advisory MYSQL05-V0001] Improper Filtering of Directory Traversal Characters in MySQL User Defined Functions  View
100741 13779 CVE-2005-2573 URL:http://marc.info/?l=bugtraq&m=112360618320729&w=2  View
100742 13779 CVE-2005-2573 FULLDISC:20050808 [AppSecInc Advisory MYSQL05-V0001] Improper Filtering of Directory Traversal Characters in MySQL User Defined Functions  View
100743 13779 CVE-2005-2573 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2005-August/035847.html  View
100744 13779 CVE-2005-2573 MISC:http://www.appsecinc.com/resources/alerts/mysql/2005-001.html  View
100745 13779 CVE-2005-2573 CONFIRM:http://mysql.bkbits.net:8080/mysql-4.0/cset@428b981bg2iwh3CbGANDaF-W6DbttA  View
100746 13779 CVE-2005-2573 CONFIRM:http://mysql.bkbits.net:8080/mysql-4.0/gnupatch@428b981bg2iwh3CbGANDaF-W6DbttA  View
100747 13779 CVE-2005-2573 XF:mysql-udf-directory-traversal(21738)  View

Related JVN