CVE-2009-4019
MySQL 5.0.x < 5.0.88 and 5.1.x < 5.1.41 - Authenticated Denial of Service via SELECT Subquery Error Handling
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2009-4019. PoCs published by Shane Bester.
AI-analyzed exploit summary This exploit demonstrates a denial-of-service vulnerability in MySQL by leveraging a malformed SQL query involving row comparisons and subqueries, causing the database to crash. It targets versions prior to MySQL 5.0.88 and 5.1.41.
Description
mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement.
Exploits (2)
This exploit demonstrates a denial-of-service vulnerability in MySQL by leveraging a malformed SQL query involving row comparisons and subqueries, causing the database to crash. It targets versions prior to MySQL 5.0.88 and 5.1.41.
This exploit demonstrates a denial-of-service vulnerability in MySQL by creating a malformed multipolygon geometry that crashes the server when processed. It targets versions prior to MySQL 5.0.88 and 5.1.41.