CVE-2009-4028

Published: Nov 30, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

Affected (104)

Products: Mysql: Mysql · Oracle: Mysql

1 product

1 product

Configuration A

104 vulnerable

Vulnerable Software	Affected Versions
Mysql Mysql	Up to 5.0.87
Mysql Mysql	Version 5.0.0
Mysql Mysql	Version 5.0.10
Mysql Mysql	Version 5.0.15
Mysql Mysql	Version 5.0.16
Mysql Mysql	Version 5.0.17
Mysql Mysql	Version 5.0.1
Mysql Mysql	Version 5.0.20
Mysql Mysql	Version 5.0.22.1.0.1
Mysql Mysql	Version 5.0.24
Mysql Mysql	Version 5.0.2
Mysql Mysql	Version 5.0.30
Mysql Mysql	Version 5.0.36
Mysql Mysql	Version 5.0.3
Mysql Mysql	Version 5.0.44
Mysql Mysql	Version 5.0.4
Mysql Mysql	Version 5.0.5.0.21
Mysql Mysql	Version 5.0.54
Mysql Mysql	Version 5.0.56
Mysql Mysql	Version 5.0.5
Mysql Mysql	Version 5.0.60
Mysql Mysql	Version 5.0.66
Mysql Mysql	Version 5.0.82
Mysql Mysql	Version 5.0.84
Mysql Mysql	Version 5.1.23
Mysql Mysql	Version 5.1.31
Mysql Mysql	Version 5.1.32
Mysql Mysql	Version 5.1.34
Mysql Mysql	Version 5.1.37
Mysql Mysql	Version 5.1.5
Oracle Mysql	Version 5.0.0 alpha
Oracle Mysql	Version 5.0.11
Oracle Mysql	Version 5.0.12
Oracle Mysql	Version 5.0.13
Oracle Mysql	Version 5.0.14
Oracle Mysql	Version 5.0.18
Oracle Mysql	Version 5.0.19
Oracle Mysql	Version 5.0.21
Oracle Mysql	Version 5.0.22
Oracle Mysql	Version 5.0.23
Oracle Mysql	Version 5.0.25
Oracle Mysql	Version 5.0.26
Oracle Mysql	Version 5.0.27
Oracle Mysql	Version 5.0.30 sp1
Oracle Mysql	Version 5.0.32
Oracle Mysql	Version 5.0.33
Oracle Mysql	Version 5.0.37
Oracle Mysql	Version 5.0.38
Oracle Mysql	Version 5.0.3 beta
Oracle Mysql	Version 5.0.41
Oracle Mysql	Version 5.0.42
Oracle Mysql	Version 5.0.45
Oracle Mysql	Version 5.0.50
Oracle Mysql	Version 5.0.51
Oracle Mysql	Version 5.0.52
Oracle Mysql	Version 5.0.6
Oracle Mysql	Version 5.0.75
Oracle Mysql	Version 5.0.77
Oracle Mysql	Version 5.0.7
Oracle Mysql	Version 5.0.81
Oracle Mysql	Version 5.0.83
Oracle Mysql	Version 5.0.85
Oracle Mysql	Version 5.0.86
Oracle Mysql	Version 5.0.8
Oracle Mysql	Version 5.1.10
Oracle Mysql	Version 5.1.11
Oracle Mysql	Version 5.1.12
Oracle Mysql	Version 5.1.13
Oracle Mysql	Version 5.1.14
Oracle Mysql	Version 5.1.15
Oracle Mysql	Version 5.1.16
Oracle Mysql	Version 5.1.17
Oracle Mysql	Version 5.1.18
Oracle Mysql	Version 5.1.19
Oracle Mysql	Version 5.1.1
Oracle Mysql	Version 5.1.20
Oracle Mysql	Version 5.1.21
Oracle Mysql	Version 5.1.22
Oracle Mysql	Version 5.1.23 a
Oracle Mysql	Version 5.1.24
Oracle Mysql	Version 5.1.25
Oracle Mysql	Version 5.1.26
Oracle Mysql	Version 5.1.27
Oracle Mysql	Version 5.1.28
Oracle Mysql	Version 5.1.29
Oracle Mysql	Version 5.1.2
Oracle Mysql	Version 5.1.30
Oracle Mysql	Version 5.1.31 sp1
Oracle Mysql	Version 5.1.33
Oracle Mysql	Version 5.1.34 sp1
Oracle Mysql	Version 5.1.35
Oracle Mysql	Version 5.1.36
Oracle Mysql	Version 5.1.37 sp1
Oracle Mysql	Version 5.1.38
Oracle Mysql	Version 5.1.39
Oracle Mysql	Version 5.1.3
Oracle Mysql	Version 5.1.40
Oracle Mysql	Version 5.1.40 sp1
Oracle Mysql	Version 5.1.4
Oracle Mysql	Version 5.1.6
Oracle Mysql	Version 5.1.7
Oracle Mysql	Version 5.1.8
Oracle Mysql	Version 5.1.9
Oracle Mysql	Version 5.1