Description
Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained from third party information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | mysql-dfsg-5.0 | 5.0.51a-24+lenny2 | DSA-1877-1 |
| Debian 4.0 | mysql-dfsg-5.0 | 5.0.32-7etch11 | DSA-1877-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mysql +4 | 5.0.77-3.el5 | RHSA-2009:1289 |
| RHEL 4 | mysql +3 | 4.1.22-2.el4_8.3 | RHSA-2010:0110 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | httpd +2 | 2.2.13-2.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | mod_ssl | 1:2.2.13-2.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | mysql +6 | 5.0.84-2.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | perl-DBD-MySQL | 4.012-1.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | perl-DBI | 1.609-1.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | php +18 | 5.2.10-1.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | php-pear | 1:1.8.1-2.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | postgresql +11 | 8.2.14-1.el5s2 | RHSA-2009:1461 |
| Red Hat Rhel Application Stack 2 | postgresql-jdbc | 8.2.510-1jpp.el5s2 | RHSA-2009:1461 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- MySQL 5.0.75 - 'sql_parse.cc' Multiple Format String Vulnerabilities EDB-33077 · dos · Jun 8, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2009:1289 Red Hat Security Advisory: mysql security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0110 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1877-1 mysql-dfsg-5.0 - arbitrary code Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1461 Red Hat Security Advisory: Red Hat Application Stack v2.4 security and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- USN-1397-1 vendor-advisory
- 20090708 MySQL <= 5.0.45 post auth format string vulnerability mailing-list
- 20090708 MySQL <= 5.0.45 post auth format string vulnerability mailing-list
- 38517 third-party-advisory
- USN-897-1 vendor-advisory
- RHSA-2009:1289 vendor-advisory
- APPLE-SA-2010-03-29-1 vendor-advisory
- 1022533 vdb-entry
- 55734 vdb-entry
- oval:org.mitre.oval:def:11857 vdb-entry signature
- ADV-2009-1857 vdb-entry
- http://support.apple.com/kb/HT4077
- mysql-dispatchcommand-format-string(51614) vdb-entry
- MDVSA-2009:179 vendor-advisory
- 35609 vdb-entry
- RHSA-2010:0110 vendor-advisory
- 35767 third-party-advisory
- 36566 third-party-advisory