Bug 466518 (CVE-2008-4456) - CVE-2008-4456 mysql: mysql command line client XSS flaw
Summary: CVE-2008-4456 mysql: mysql command line client XSS flaw
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-4456
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:
Depends On: 502169 512255 512257 516803
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-10-10 17:50 UTC by Josh Bressers
Modified: 2019-09-29 12:26 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-04-24 04:20:50 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1289 0 normal SHIPPED_LIVE Moderate: mysql security and bug fix update 2009-09-01 13:32:14 UTC
Red Hat Product Errata RHSA-2009:1461 0 normal SHIPPED_LIVE Important: Red Hat Application Stack v2.4 security and enhancement update 2009-09-23 21:38:40 UTC
Red Hat Product Errata RHSA-2010:0110 0 normal SHIPPED_LIVE Moderate: mysql security update 2010-02-16 16:27:21 UTC

Description Josh Bressers 2008-10-10 17:50:39 UTC 
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document.

http://www.securityfocus.com/archive/1/archive/1/496842/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/496877/100/0/threaded
http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability
http://bugs.mysql.com/bug.php?id=27884
http://secunia.com/advisories/32072
Comment 2 Jan Lieskovsky 2009-05-14 17:21:32 UTC 
The issue has been rated as having low security impact, as this can only be a security flaw when all following conditions are met:

1) A database contains untrusted third party data.
2) A site uses the mysql command line tool with the --html option.
3) The resulting HTML output is placed and viewed on a web site the attacker    
   could use to launch a cross-site-scripting attack.
Comment 5 errata-xmlrpc 2009-09-02 09:45:30 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1289 https://rhn.redhat.com/errata/RHSA-2009-1289.html
Comment 6 errata-xmlrpc 2009-09-02 12:10:03 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1289 https://rhn.redhat.com/errata/RHSA-2009-1289.html
Comment 8 Vincent Danen 2009-09-04 21:18:37 UTC 
This issue does affect Red Hat Enterprise Linux 3 and 4, however the Security Response Team has rated it has having low impact and may be addressed in a future update.
Comment 9 errata-xmlrpc 2009-09-23 21:39:01 UTC 
This issue has been addressed in following products:

  Red Hat Web Application Stack for RHEL 5

Via RHSA-2009:1461 https://rhn.redhat.com/errata/RHSA-2009-1461.html
Comment 10 errata-xmlrpc 2010-02-16 16:27:44 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2010:0110 https://rhn.redhat.com/errata/RHSA-2010-0110.html
Note You need to log in before you can comment on or make changes to this bug.