[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20091121205926.GA28278@janus.mylan>
Date: Sat, 21 Nov 2009 21:59:26 +0100
From: Sergei Golubchik <serg@...ql.com>
To: Jan Lieskovsky <jlieskov@...hat.com>
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
oss-security@...ts.openwall.com, security@...ql.com
Subject: Re: CVE Request - MySQL - 5.0.88
Hi, Jan!
On Nov 21, Jan Lieskovsky wrote:
> Hi Josh, Steve, vendors,
>
> MySQL upstream has released latest 5.0.88 version of their Community
> Server, fixing one security issue:
...
> While the other two (three issues) looks too to be security relevant:
>
> * Error handling was missing for SELECT statements containing
> subqueries in the WHERE clause and that assigned a SELECT
> result to a user variable. The server could crash as a result.
> (Bug#48291: http://bugs.mysql.com/48291)
>
> This looks to be from adjacent network exploitable mysqld DoS.
Yes.
> * If the first argument to GeomFromWKB() function was a geometry
> value, the function just returned its value. However, it
> failed to preserve the argument's null_value flag, which
> caused an unexpected NULL value to be returned to the caller,
> resulting in a server crash.
> (Bug#47780: http://bugs.mysql.com/47780)
>
> Same case as the above
Yes.
> * Failure to treat BIT values as unsigned could lead to
> unpredictable results.
> (Bug#42803: http://bugs.mysql.com/42803)
>
> Also this one seems to be security related - upstream bug speaks about
> invalid memory access and didn't check the code if this could lead to
> heap overflow once the comparison fails.
No, looks safe. It reads one byte and thinks it's a bool:
class Field_num ... { ...
bool unsigned_flag;
while it's somewhere in the middle of a pointer:
class Field_bit ... { ...
uchar *bit_ptr;
The worst that can happen - MySQL could think the value is signed (BIT
values are always unsigned) and during the optimization phase won't
notice that the condition like "unsigned_value > negative_number" is
always true. Not a big deal.
Regards / Mit vielen Grüßen,
Sergei
--
__ ___ ___ ____ __
/ |/ /_ __/ __/ __ \/ / Sergei Golubchik <serg@....com>
/ /|_/ / // /\ \/ /_/ / /__ Principal Software Engineer/Server Architect
/_/ /_/\_, /___/\___\_\___/ Sun Microsystems GmbH, HRB München 161028
<___/ Sonnenallee 1, 85551 Kirchheim-Heimstetten
Geschäftsführer: Thomas Schroeder, Wolfgang Engels, Wolf Frenkel
Vorsitzender des Aufsichtsrates: Martin Häring
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
