CVE-2008-3963

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 6.5%

from disclosure to weapon0 days

Published on NVDSep 10

1st PoCMar 28

exploitation probability

6.5%top 7% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/32348

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://bugs.mysql.com/bug.php?id=35658 http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html https://bugs.gentoo.org/237166 http://secunia.com/advisories/31769 http://secunia.com/advisories/32759 http://secunia.com/advisories/32769 http://secunia.com/advisories/34907 http://secunia.com/advisories/36566 https://exchange.xforce.ibmcloud.com/vulnerabilities/45042