CVE-2003-0780 Memory corruption in n/a

Critical 9.0 Published 12 Sep 2003 Updated 8 Aug 2024

Attackers with ALTER TABLE privileges can execute arbitrary code via a buffer overflow in the password handling function.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2003-0780?

CVE-2003-0780 is a critical memory corruption vulnerability in Conectiva Linux, published on 12 Sep 2003. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.

Which versions are affected by CVE-2003-0780?

It affects 3 products.

Products include Conectiva Linux, Mysql Mysql, Oracle Mysql.

How do I fix CVE-2003-0780?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2003-0780 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2003-0780 exists.

Public exploit code: 2 Exploit-DB entries.

All Conectiva Linux vulnerabilities

Sources

Also known as DSA-381, GHSA-fq6h-5jh8-rmxv.