CVE

Id
34223  
CVE No.
CVE-2008-4106  
Status
Candidate  
Description
WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user"s password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability." NOTE: the attacker can discover the random password by also exploiting CVE-2008-4107.  
Phase
Assigned (20080915)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
374803 34223 CVE-2008-4106 BUGTRAQ:20080911 Advisory 05/2008: Wordpress user_login Column SQL Truncation Vulnerability  View
374804 34223 CVE-2008-4106 URL:http://www.securityfocus.com/archive/1/archive/1/496287/100/0/threaded  View
374805 34223 CVE-2008-4106 MILW0RM:6397  View
374806 34223 CVE-2008-4106 URL:http://www.milw0rm.com/exploits/6397  View
374807 34223 CVE-2008-4106 MILW0RM:6421  View
374808 34223 CVE-2008-4106 URL:http://www.milw0rm.com/exploits/6421  View
374809 34223 CVE-2008-4106 MLIST:[oss-security] 20080911 CVE request: wordpress < 2.6.2  View
374810 34223 CVE-2008-4106 URL:http://www.openwall.com/lists/oss-security/2008/09/11/6  View
374811 34223 CVE-2008-4106 MLIST:[oss-security] 20080916 Re: CVE request: wordpress < 2.6.2  View
374812 34223 CVE-2008-4106 URL:http://marc.info/?l=oss-security&m=122152830017099&w=2  View
374813 34223 CVE-2008-4106 MISC:http://www.sektioneins.de/advisories/SE-2008-05.txt  View
374814 34223 CVE-2008-4106 MISC:http://www.suspekt.org/2008/08/18/mysql-and-sql-column-truncation-vulnerabilities/  View
374815 34223 CVE-2008-4106 CONFIRM:http://wordpress.org/development/2008/09/wordpress-262/  View
374816 34223 CVE-2008-4106 DEBIAN:DSA-1871  View
374817 34223 CVE-2008-4106 URL:http://www.debian.org/security/2009/dsa-1871  View
374818 34223 CVE-2008-4106 FEDORA:FEDORA-2008-7760  View
374819 34223 CVE-2008-4106 URL:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00607.html  View
374820 34223 CVE-2008-4106 FEDORA:FEDORA-2008-7902  View
374821 34223 CVE-2008-4106 URL:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00629.html  View
374822 34223 CVE-2008-4106 BID:31068  View
374823 34223 CVE-2008-4106 URL:http://www.securityfocus.com/bid/31068  View
374824 34223 CVE-2008-4106 VUPEN:ADV-2008-2553  View
374825 34223 CVE-2008-4106 URL:http://www.vupen.com/english/advisories/2008/2553  View
374826 34223 CVE-2008-4106 SECTRACK:1020869  View
374827 34223 CVE-2008-4106 URL:http://securitytracker.com/id?1020869  View
374828 34223 CVE-2008-4106 SECUNIA:31737  View
374829 34223 CVE-2008-4106 URL:http://secunia.com/advisories/31737  View
374830 34223 CVE-2008-4106 SECUNIA:31870  View
374831 34223 CVE-2008-4106 URL:http://secunia.com/advisories/31870  View
374832 34223 CVE-2008-4106 SREASON:4272  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
49550 JVNDB-2008-004860 Microsoft SQL Server 2000 の ToolsBinnsqlvdir.dll の SQLVDIRLib.SQLVDirControl ActiveX コントロールにおけるバッファオーバーフローの脆弱性 Microsoft SQL Server 2000 の ToolsBinnsqlvdir.dll の SQLVDIRLib.SQLVDirControl ActiveX コントロールには、バッファオーバーフローの脆弱性が存在します。 CVE-2008-4110 34223 7.6 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-004860.html  View