• info
• discussion
• exploit
• solution
• references

MySQL Mysql_real_escape Function SQL Injection Vulnerability

Solution:
Versions 5.0.22-1-0.1 and 4.1.20 have been released to address this issue; please see the reference section for more information.


MySQL AB MySQL 4.1.11a

• Debian libmysqlclient14-dev_4.1.11a-4sarge4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_alpha.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_amd64.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_arm.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_hppa.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_i386.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_ia64.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_m68k.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_mips.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_mipsel.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_powerpc.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_s390.deb


• Debian libmysqlclient14-dev_4.1.11a-4sarge4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14-dev_4.1.11a-4sarge4_sparc.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_alpha.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_amd64.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_arm.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_hppa.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_i386.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_ia64.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_m68k.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_mips.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_mipsel.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_powerpc.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_s390.deb


• Debian libmysqlclient14_4.1.11a-4sarge4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysql client14_4.1.11a-4sarge4_sparc.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_alpha.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_amd64.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_arm.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_hppa.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_i386.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_ia64.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_m68k.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_mips.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_mipsel.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_powerpc.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_s390.deb


• Debian mysql-client-4.1_4.1.11a-4sarge4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-cl ient-4.1_4.1.11a-4sarge4_sparc.deb


• Debian mysql-common-4.1_4.1.11a-4sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-co mmon-4.1_4.1.11a-4sarge4_all.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_alpha.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_amd64.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_arm.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_hppa.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_i386.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_ia64.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_m68k.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_mips.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_mipsel.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_powerpc.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_s390.deb


• Debian mysql-server-4.1_4.1.11a-4sarge4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-se rver-4.1_4.1.11a-4sarge4_sparc.deb

Apple Mac OS X Server 10.4

• Apple Mac OS X v10.4.9
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.1

• Apple Mac OS X v10.4.9
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.2

• Apple Mac OS X v10.4.9
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.3

• Apple Mac OS X v10.4.9
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.4

• Apple Mac OS X v10.4.9
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.5

• Apple Mac OS X v10.4.9
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.6

• Apple Mac OS X v10.4.9
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.7

• Apple Mac OS X v10.4.9
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.8

• Apple Mac OS X v10.4.9
  http://www.apple.com/support/downloads/

MySQL AB MySQL 4.1.13

• Trustix mysql-4.1.15-3tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix mysql-bench-4.1.15-3tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix mysql-client-4.1.15-3tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix mysql-devel-4.1.15-3tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix mysql-libs-4.1.15-3tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix mysql-shared-4.1.15-3tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/