Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security VulnWatch
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Full-disclosure] Re: [AppSecInc Advisory MYSQL05-V0002] Buffer Overflow

from [David Litchfield] Network Security [Permanent Link]
Subject: [Full-disclosure] Re: [AppSecInc Advisory MYSQL05-V0002] Buffer Overflow in MySQL User Defined Functions
Date: Tue, 9 Aug 2005 01:38:45 +0100 
Buffer Overflow in MySQL User Defined Functions
Risk level: LOW
Credits: This vulnerability was discovered and researched by Reid
Borsuk of Application Security Inc.

How can this even be marked as low risk? If you're loading a library into mysql's address space then you're already executing "arbitrary code". It's important that we, as security researchers, don't desensitize the readership with pointless "vulnerability" posts otherwise people begin to turn off. Sure - you've found some sloppy code in mysql - get it looked at by all means but please don't try to create a risk, whether low or not, where there really is none.

Cheers,
David "got out of the wrong side of bed this morning" Litchfield 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Full-disclosure] [AppSecInc Advisory MYSQL05-V0001] Improper Filtering of Directory Traversal Characters in MySQL User Defined Functions, Team SHATTER
Next by Date:  [Full-disclosure] iDEFENSE Security Advisory 08.09.05: AWStats ShowInfoURL Remote Command Execution Vulnerability, iDEFENSE Labs
Previous by Thread:  [Full-disclosure] [AppSecInc Advisory MYSQL05-V0002] Buffer Overflow in MySQL User Defined Functions, Team SHATTER
Next by Thread:  [Full-disclosure] [AppSecInc Advisory MYSQL05-V0003] Multiple Issues with MySQL User Defined Functions, Team SHATTER
Indexes:  [Date] [Thread] [Top] [All Lists]