oss-security - Re: [Full-disclosure] MySQL Denial of Service Zeroday PoC

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20130228085033.GA348@meddwl.fritz.box>
Date: Thu, 28 Feb 2013 09:50:33 +0100
From: Sergei Golubchik <serg@...monty.org>
To: oss-security@...ts.openwall.com, Kurt Seifried <kseifried@...hat.com>
Cc: full-disclosure@...ts.grok.org.uk, Steven Christey <coley@...re.org>,
	security@...iadb.org
Subject: Re: [Full-disclosure] MySQL Denial of Service Zeroday PoC

Hi, Kurt!

> > Cheerio, Kingcope
> 
> So normally for MySQL issues Oracle would assign the CVE #. However in
> this case we have a bit of a time constraint (it's a weekend and this
> is blowing up quickly)  and the impacts are potentially quite severe.
> So I've spoken with some other Red Hat SRT members and we feel it is
> best to get CVE #'s assigned for these issues quickly so we can refer
> to them properly.
> 
> I am also adding MySQL, Oracle, MariaDB, OSS-SEC, Steven Christey,
> cve-assign and OSVDB to the CC so that everyone is aware of what is
> going on.
> 
> http://seclists.org/fulldisclosure/2012/Dec/7

I've just looked at CVE-2012-5614 - it's not quite correct:

* it claims the bug was in UpdateXML - if you look at the exploit,
  you'll see that it sends an invalid packet to the server, the
  UpdateXML part is after the exit statement, so it's a dead code.

* it references https://mariadb.atlassian.net/browse/MDEV-3910
  which is about the invalid packet, not about UpdateXML

* but MDEV-3910 also mentions that this invalid packet crash was
  introduced in MySQL-5.5.18 and fixed in MySQL-5.5.21. While CVE entry
  says that MySQL 5.5.19 and MariaDB 5.5.28a are vulnerable.

* UpdateXML on the other hand, was vulnerable only in MySQL, starting
  from 5.6.6 and fixed in 5.6.10. Earlier MySQL versions and all MariaDB
  are not affected.

Regards,
Sergei

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.