Description
The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte, which causes a buffer over-read.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | mysql-dfsg | 4.0.24-10sarge2 | DSA-1079-1 |
| Debian 3.1 | mysql-dfsg-4.1 | 4.1.11a-4sarge3 | DSA-1073-1 |
| Debian 3.0 | mysql | 3.23.49-8.15 | DSA-1071-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | mysql +3 | 4.1.20-1.RHEL4.1 | RHSA-2006:0544 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- MySQL 4.1.18/5.0.20 - Local/Remote Information Leakage EDB-1742 · remote · May 2, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2006:0544 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1071-1 mysql - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1073-1 mysql-dfsg-4.1 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1079-1 mysql-dfsg - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 2006-0028 vendor-advisory
- 19929 third-party-advisory
- 20073 third-party-advisory
- http://bugs.debian.org/365938
- TA07-072A third-party-advisory
- DSA-1079 vendor-advisory
- ADV-2006-1633 vdb-entry
- 20060516 UPDATE: [ GLSA 200605-13 ] MySQL: Information leakage mailing-list
- 20424 third-party-advisory
- GLSA-200605-13 vendor-advisory
- APPLE-SA-2007-03-13 vendor-advisory
- 840 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- SUSE-SA:2006:036 vendor-advisory
- SUSE-SR:2006:012 vendor-advisory
- 17780 vdb-entry
- MDKSA-2006:084 vendor-advisory
- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html
- 20241 third-party-advisory
- 20762 third-party-advisory
- mysql-login-packet-info-disclosure(26236) vdb-entry
- 236703 vendor-advisory
- SSA:2006-155-01 vendor-advisory
- 20333 third-party-advisory
- 1016017 vdb-entry
- 20002 third-party-advisory
- 20223 third-party-advisory
- 20076 third-party-advisory
- http://www.wisec.it/vulns.php?page=7
- DSA-1071 vendor-advisory
- ADV-2008-1326 vdb-entry
- ADV-2007-0930 vdb-entry
- 20060502 MySQL Anonymous Login Handshake - Information Leakage. mailing-list
- 20253 third-party-advisory
- USN-283-1 vendor-advisory
- 20457 third-party-advisory
- DSA-1073 vendor-advisory
- 29847 third-party-advisory
- 20625 third-party-advisory
- RHSA-2006:0544 vendor-advisory
- oval:org.mitre.oval:def:9918 vdb-entry signature
- 24479 third-party-advisory