Vulnerability record · CVE-2003-0780 · published 22 September 2003
CVE-2003-0780: MySQL get_salt_from_password buffer overflow allows code execution
Mysql · Mysql
MySQL 4.0.14 and earlier, plus 3.23.x, contain a buffer overflow in get_salt_from_password in sql_acl.cc. An attacker with ALTER TABLE privileges can supply an overly long Password field to trigger the overflow. Because the flaw is in core privilege-handling code, successful exploitation can compromise the database server process.
Description
Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.
AV:N/AC:L/Au:S/C:C/I:C/A:C
Automated analysis
high priorityThe flaw allows authenticated code execution with a very high EPSS score and public exploit references, though it requires ALTER TABLE privileges and affects only legacy MySQL versions.
What it is
MySQL 4.0.14 and earlier, plus 3.23.x, contain a buffer overflow in get_salt_from_password in sql_acl.cc. An attacker with ALTER TABLE privileges can supply an overly long Password field to trigger the overflow. Because the flaw is in core privilege-handling code, successful exploitation can compromise the database server process.
Impact
An attacker with ALTER TABLE privileges can execute arbitrary code with the privileges of the MySQL server, leading to full compromise of the database host. This can expose or destroy all data managed by that server.
Attack surface
The flaw is reached over the network through MySQL's normal SQL interface by issuing an ALTER TABLE statement with a crafted long Password value. It requires an authenticated account that holds ALTER TABLE privileges; no user interaction beyond sending the SQL statement is needed.
Exploitation
The record is not listed in CISA KEV, but EPSS is very high at 0.78367 (99.56th percentile), and a reference is tagged Exploit, indicating public exploit material exists. No ransomware group usage is documented.
What to do
- Upgrade MySQL to a fixed release; apply the vendor patches referenced by Debian DSA-381 and Red Hat RHSA-2003-281/282.
- Restrict ALTER TABLE privileges to only trusted administrative accounts and review existing grants.
- Limit network exposure of MySQL to trusted hosts and use firewalls or bind-address controls.
- Monitor for and remove any unnecessary accounts that can issue ALTER TABLE statements.
Detection
- Audit MySQL general query logs for ALTER TABLE statements containing unusually long Password values.
- Alert on ALTER TABLE activity from accounts that do not normally perform schema changes.
- Monitor MySQL server processes for unexpected child processes or outbound connections after schema changes.
- Review database account privileges for unnecessary ALTER TABLE grants.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-0780 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-0780), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
