{"id":"CVE-2009-4484","aliases":["DSA-1997-1","EUVD-2009-4451","GHSA-r9xr-rjgc-3q5h"],"status":"published","title":"Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in...","description":"Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.69552,"percentile":0.99368,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-787"],"published":"2009-12-30T21:00:00Z","modified":"2026-06-16T23:13:45Z","exploits":[{"source":"metasploit","id":"exploit/linux/mysql/mysql_yassl_getname","title":"MySQL yaSSL CertDecoder::GetName Buffer Overflow","type":"exploit","platform":"Linux","date":"2010-01-25","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/mysql/mysql_yassl_getname"},{"source":"exploitdb","id":"EDB-16850","title":"MySQL - yaSSL CertDecoder::GetName Buffer Overflow (Metasploit)","type":"remote","platform":"linux","date":"2010-04-30","verified":true,"url":"https://www.exploit-db.com/exploits/16850"}],"affected":[{"source":"osv","ecosystem":"Debian:4.0","package":"mysql-dfsg-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.32-7etch12"}]}],"versions":["5.0.32-7etch1","5.0.32-7etch10","5.0.32-7etch11","5.0.32-7etch3","5.0.32-7etch3~bpo31+1","5.0.32-7etch4","5.0.32-7etch5","5.0.32-7etch5~bpo31+1","5.0.32-7etch6","5.0.32-7etch8"],"bundled":3},{"source":"osv","ecosystem":"Debian:5.0","package":"mysql-dfsg-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.51a-24+lenny3"}]}],"versions":["5.0.51a-23","5.0.51a-24","5.0.51a-24+lenny1","5.0.51a-24+lenny1~bpo40+1","5.0.51a-24+lenny2","5.0.51a-24+lenny2+spu1","5.0.51a-24+lenny2~bpo40+1","5.0.51a-24~bpo40+1"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"mariadb","product":"mariadb"},{"vendor":"oracle","product":"mysql"},{"vendor":"wolfssl","product":"yassl"}],"references":[{"url":"http://intevydis.com/mysql_overflow1.py.txt","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://dev.mysql.com/doc/refman/5.1/en/news-5-1-43.html","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/38573","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1397-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"http://secunia.com/advisories/37493","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.yassl.com/release.html","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"http://www.yassl.com/news.html#yassl199","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"http://www.intevydis.com/blog/?p=106","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://intevydis.com/mysql_demo.html","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.html","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/38364","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://secunia.com/advisories/38517","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://yassl.cvs.sourceforge.net/viewvc/yassl/yassl/taocrypt/src/asn.cpp?r1=1.13\u0026r2=1.14","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/37974","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://securitytracker.com/id?1023513","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://ubuntu.com/usn/usn-897-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"http://www.metasploit.com/modules/exploit/linux/mysql/mysql_yassl_getname","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/0236","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"http://archives.neohapsis.com/archives/dailydave/2010-q1/0002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Broken Link"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=555313","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"http://bugs.mysql.com/bug.php?id=50227","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/37640","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/55416","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.intevydis.com/blog/?p=57","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://isc.sans.org/diary.html?storyid=7900","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://lists.mysql.com/commits/96697","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1023402","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://dev.mysql.com/doc/refman/5.0/en/news-5-0-90.html","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"http://www.osvdb.org/61956","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link"]},{"url":"http://intevydis.com/vd-list.shtml","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/38344","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/37943","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.vupen.com/english/advisories/2010/0233","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"http://lists.immunitysec.com/pipermail/dailydave/2010-January/006020.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Broken Link"]},{"url":"http://www.debian.org/security/2010/dsa-1997","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4484"},{"url":"https://github.com/advisories/GHSA-r9xr-rjgc-3q5h"}],"sources":{"cve":[{"id":"CVE-2009-4484","description":"Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.","status":"published","published":"2009-12-30T21:00:00Z","modified":"2024-08-07T07:01:20.829Z","updated_at":"2026-11-02T14:33:24.451733Z"}],"euvd":[{"id":"EUVD-2009-4451","description":"Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.","status":"published","published":"2009-12-30T21:00:00Z","modified":"2024-08-07T07:01:20Z","updated_at":"2026-11-03T01:39:10.134983Z"}],"ghsa":[{"id":"GHSA-r9xr-rjgc-3q5h","title":"Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in...","description":"Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.","status":"published","published":"2022-05-02T03:55:14Z","modified":"2023-01-31T05:09:09Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:49:29.477947Z"}],"nvd":[{"id":"CVE-2009-4484","description":"Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.","status":"published","published":"2009-12-30T21:30:00.547Z","modified":"2026-06-16T23:13:45.16Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:01:38.33745Z"}],"osv":[{"id":"DSA-1997-1","title":"mysql-dfsg-5.0 - several vulnerabilities","status":"published","published":"2010-02-14T00:00:00Z","modified":"2026-03-09T01:21:02.100535Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}