Summaryinfo

A vulnerability, which was classified as critical, was found in Oracle MySQL Server up to 5.7.43/8.0.34/8.1.0. This vulnerability affects unknown code of the component Compiling. Such manipulation leads to an unknown weakness. This vulnerability is uniquely identified as CVE-2023-38545. The attack can be launched remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in Oracle MySQL Server up to 5.7.43/8.0.34/8.1.0 (Database Software) and classified as critical. Affected by this issue is some unknown functionality of the component Compiling. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 10/17/2023 as Oracle Critical Patch Update Advisory - October 2023. The advisory is available at oracle.com. This vulnerability is handled as CVE-2023-38545. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available.

A public exploit has been developed in Bash and been published before and not just after the advisory. The exploit is available at github.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 210338 (Oracle Business Intelligence Enterprise Edition (OAS 7.0) (October 2024 CPU)), which helps to determine the existence of the flaw in a target environment. The code used by the exploit is:

#!/bin/bash
printf "HTTP/1.1 301 Moved Permanently\nLocation: http:///$(printf 'A%.0s' {0..60000})/\nContent-Length: 0\nConnection: close\n\n" | nc -C -nvlp 8000 &
curl -L --limit-rate 32768 -x socks5h://localhost:10801 localhost:8000

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210338). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Vendor

• Oracle

Name

• MySQL Server

Version

• 5.7.0
• 5.7.1
• 5.7.2
• 5.7.3
• 5.7.4
• 5.7.5
• 5.7.6
• 5.7.7
• 5.7.8
• 5.7.9
• 5.7.10
• 5.7.11
• 5.7.12
• 5.7.13
• 5.7.14
• 5.7.15
• 5.7.16
• 5.7.17
• 5.7.18
• 5.7.19
• 5.7.20
• 5.7.21
• 5.7.22
• 5.7.23
• 5.7.24
• 5.7.25
• 5.7.26
• 5.7.27
• 5.7.28
• 5.7.29
• 5.7.30
• 5.7.31
• 5.7.32
• 5.7.33
• 5.7.34
• 5.7.35
• 5.7.36
• 5.7.37
• 5.7.38
• 5.7.39
• 5.7.40
• 5.7.41
• 5.7.42
• 5.7.43
• 8.0
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 8.0.6
• 8.0.7
• 8.0.8
• 8.0.9
• 8.0.10
• 8.0.11
• 8.0.12
• 8.0.13
• 8.0.14
• 8.0.15
• 8.0.16
• 8.0.17
• 8.0.18
• 8.0.19
• 8.0.20
• 8.0.21
• 8.0.22
• 8.0.23
• 8.0.24
• 8.0.25
• 8.0.26
• 8.0.27
• 8.0.28
• 8.0.29
• 8.0.30
• 8.0.31
• 8.0.32
• 8.0.33
• 8.0.34
• 8.1.0

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion