CVE-2002-0969

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

Buffer overflow in MySQL daemon (mysqld) before 3.23.50, and 4.0 beta before 4.02, on the Win32 platform, allows local users to execute arbitrary code via a long "datadir" parameter in the my.ini initialization file, whose permissions on Windows allow Full Control to the Everyone group.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0004.htmlBroken Link, Exploit, Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=103358628011935&w=2Mailing List
http://www.iss.net/security_center/static/10243.phpBroken Link, Vendor Advisory
http://www.mysql.com/documentation/mysql/bychapter/manual_News.html#News-3.23.xBroken Link
http://www.securityfocus.com/bid/5853Broken Link, Third Party Advisory, VDB Entry
http://www.westpoint.ltd.uk/advisories/wp-02-0003.txtBroken Link
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0004.htmlBroken Link, Exploit, Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=103358628011935&w=2Mailing List
http://www.iss.net/security_center/static/10243.phpBroken Link, Vendor Advisory
http://www.mysql.com/documentation/mysql/bychapter/manual_News.html#News-3.23.xBroken Link
http://www.securityfocus.com/bid/5853Broken Link, Third Party Advisory, VDB Entry
http://www.westpoint.ltd.uk/advisories/wp-02-0003.txtBroken Link

Timeline

Published: Oct 11, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-09707.5The SSL capability for Konqueror in KDE 3.0.2 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, w CVE-2002-09714.6Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging Syste CVE-2002-09724.6Buffer overflows in PostgreSQL 7.2 allow attackers to cause a denial of service and possibly execute arbitrary code via long arguments to th CVE-2002-09734.6Integer signedness error in several system calls for FreeBSD 4.6.1 RELEASE-p10 and earlier may allow attackers to access sensitive kernel me CVE-2002-09745.0Help and Support Center for Windows XP allows remote attackers to delete arbitrary files via a link to the hcp: protocol that accesses upldd CVE-2002-09757.5Buffer overflow in Microsoft DirectX Files Viewer ActiveX control (xweb.ocx) 2.0.6.15 and earlier allows remote attackers to execute arbitra CVE-2002-09766.4Internet Explorer 4.0 and later allows remote attackers to read arbitrary files via a web page that accesses a legacy XML Datasource applet CVE-2002-09777.5Buffer overflow in Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to execute arbitrary code via a CVE-2002-09785.0Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to upload or download arbitrary files to arbitrary CVE-2002-09797.5The Java logging feature for the Java Virtual Machine in Internet Explorer writes output from functions such as System.out.println to a know CVE-2002-09807.5The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder, which allows CVE-2002-09817.2Buffer overflow in ndcfg command for UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to execute arbitrary code via a long command line