Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4484 to the following vulnerability:
Buffer overflow in the server in MySQL 5.0.51a on Linux allows remote attackers
to execute arbitrary code via crafted data to TCP port 3306, as demonstrated by
the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: as of 20100106,
this disclosure has no actionable information. However, because the VulnDisco
Pack author is a reliable researcher, the issue is being assigned a CVE
identifier for tracking purposes.
More details about the issue may be disclosed in about 2 weeks:
I'm told that this bug is in yassl, which is mysql's private reimplementation of SSL. Since we don't use that, rather the standard openssl library, this issue doesn't affect any Red Hat build.
Additional details and PoC published on Intevydis blog:
Upstream commits (5.0 and 5.1 branches):
As mentioned above, MySQL packages in Red Hat Enterprise Linux and Fedora are linked against OpenSSL and not yaSSL. Affected code is not used.