CVE-2008-0226
HIGH severity · CVSS 7.5 · Memory corruption
7.5CVSS HIGH
Summary
Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) "input_buffer& operator>>" in yassl_imp.cpp.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impact—
Exploit probability (EPSS)92%
AV:N/AC:L/Au:N/C:P/I:P/A:P
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://bugs.mysql.com/33814
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlAdvisory
- http://secunia.com/advisories/28324
- http://secunia.com/advisories/28419
- http://secunia.com/advisories/28597
- http://secunia.com/advisories/29443
- http://secunia.com/advisories/32222