CVE-2009-4484: canonical ubuntu_linux Out-of-bounds Write

Modified

Published 30-12-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-4484 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 69.55% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 30-04-2010)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

69.55%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 1

DSA-1997-1

Timeline

30-12-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

69.55%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 69.55% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found

referenceUnverified
Exploit Reference (bugs.mysql.com)
Maturity: unknown
exploit-databaseremotelinuxVerified
MySQL - yaSSL CertDecoder::GetName Buffer Overflow (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
MySQL yaSSL CertDecoder::GetName Buffer Overflow
exploit/linux/mysql/mysql_yassl_getname
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Canonical1 product

ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04 | 9.10 | 10.04 | 10.10 | 11.04 | 11.10

Debian1 product

debian_linuxEOL4.0 | 5.0 | 6.0

Mariadb1 product

mariadb≥ 5.1, < 5.1.42

Oracle1 product

mysqlEOL≥ 5.0.0, < 5.0.90 | ≥ 5.1.0, < 5.1.43 | 5.0.0:milestone1 | 5.0.0:milestone2

Wolfssl1 product

yassl< 1.9.9

5 vendors · 5 products

References

37 links

intevydis.com/mysql_overflow1.py.txtX Refsource MISCBroken Link
dev.mysql.com/doc/refman/5.1/en/news-5-1-43.htmlX Refsource CONFIRMBroken Link
secunia.com/advisories/38573Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/USN-1397-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/37493Third Party AdvisoryX Refsource SECUNIA
www.yassl.com/release.htmlX Refsource CONFIRMBroken Link
www.yassl.com/news.htmlX Refsource CONFIRMBroken Link
bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1X Refsource CONFIRMBroken Link
www.intevydis.com/blog/?p=106X Refsource MISCBroken Link
intevydis.com/mysql_demo.htmlX Refsource MISCBroken Link

Show all 37 references

intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.htmlX Refsource MISCBroken Link
secunia.com/advisories/38364Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/38517Third Party AdvisoryX Refsource SECUNIA
yassl.cvs.sourceforge.net/viewvc/yassl/yassl/taocrypt/src/asn.cpp?r1=1.13&r2=1.14X Refsource CONFIRMThird Party Advisory
www.securityfocus.com/bid/37974VDB EntryX Refsource BIDThird Party Advisory
securitytracker.com/id?1023513VDB EntryX Refsource SECTRACKThird Party Advisory
ubuntu.com/usn/usn-897-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.metasploit.com/modules/exploit/linux/mysql/mysql_yassl_getnameX Refsource MISCThird Party Advisory
www.vupen.com/english/advisories/2010/0236VDB EntryX Refsource VUPENThird Party Advisory
archives.neohapsis.com/archives/dailydave/2010-q1/0002.htmlMailing ListX Refsource MLISTBroken Link
bugzilla.redhat.com/show_bug.cgi?id=555313X Refsource CONFIRMIssue TrackingThird Party Advisory
bugs.mysql.com/bug.php?id=50227X Refsource CONFIRMExploitIssue TrackingVendor Advisory
www.securityfocus.com/bid/37640VDB EntryX Refsource BIDThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/55416VDB EntryX Refsource XFThird Party Advisory
www.intevydis.com/blog/?p=57X Refsource MISCBroken Link
isc.sans.org/diary.html?storyid=7900X Refsource MISCThird Party Advisory
lists.mysql.com/commits/96697Mailing ListX Refsource MLISTPatchVendor Advisory
securitytracker.com/id?1023402VDB EntryX Refsource SECTRACKThird Party Advisory
dev.mysql.com/doc/refman/5.0/en/news-5-0-90.htmlX Refsource CONFIRMBroken Link
www.osvdb.org/61956VDB EntryX Refsource OSVDBBroken Link
intevydis.com/vd-list.shtmlX Refsource MISCBroken Link
secunia.com/advisories/38344Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/37943VDB EntryX Refsource BIDThird Party Advisory
www.vupen.com/english/advisories/2010/0233VDB EntryX Refsource VUPENThird Party Advisory
lists.immunitysec.com/pipermail/dailydave/2010-January/006020.htmlMailing ListX Refsource MLISTBroken Link
www.debian.org/security/2010/dsa-1997Vendor AdvisoryX Refsource DEBIANThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2009-4484OvalAdvisory