CVE-2002-0969

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2002-10-11 · updated 2026-06-16
Weakness: CWE-120

Description

Buffer overflow in MySQL daemon (mysqld) before 3.23.50, and 4.0 beta before 4.02, on the Win32 platform, allows local users to execute arbitrary code via a long "datadir" parameter in the my.ini initialization file, whose permissions on Windows allow Full Control to the Everyone group.

Affected products

MySQL Server: before 3.23.50; from 4.0.0 through 4.0.2 — fixed in 3.23.50

How to fix

Upgrade to a fixed version: MySQL Server 3.23.50. Check the vendor advisory for mitigations.

References

http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0004.html
http://marc.info/?l=bugtraq&m=103358628011935&w=2
http://www.iss.net/security_center/static/10243.php
http://www.mysql.com/documentation/mysql/bychapter/manual_News.html#News-3.23.x
http://www.securityfocus.com/bid/5853
http://www.westpoint.ltd.uk/advisories/wp-02-0003.txt
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0004.html
http://marc.info/?l=bugtraq&m=103358628011935&w=2
http://www.iss.net/security_center/static/10243.php
http://www.mysql.com/documentation/mysql/bychapter/manual_News.html#News-3.23.x
http://www.securityfocus.com/bid/5853
http://www.westpoint.ltd.uk/advisories/wp-02-0003.txt

Get alerted when CVE-2002-0969 or the next vulnerability affects your stack