CVE-2007-6304 Denial of service in n/a

Medium 5.0 Published 10 Dec 2007 Updated 7 Aug 2024

Remote MySQL servers can crash the federated handler and daemon via malformed responses to SHOW TABLE STATUS queries, causing denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2007-6304?

CVE-2007-6304 is a medium-severity denial of service vulnerability in Mysql Mysql, published on 10 Dec 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The federated engine in MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4, when performing a certain SHOW TABLE STATUS query, allows remote MySQL servers to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns.

Which versions are affected by CVE-2007-6304?

It affects 2 products.

Products include Mysql Mysql, Oracle Mysql.

How do I fix CVE-2007-6304?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2007-6304 being exploited?

There is no known exploitation of CVE-2007-6304 in the wild and no public exploit code.

All Mysql Mysql vulnerabilities

Sources

Also known as CVE-2008-0627, GHSA-gmq9-53hm-68cj.