Bug 1380375 (CVE-2016-1246)

Summary:	CVE-2016-1246 perl-DBD-MySQL: Buffer overflow triggered by user supplied data
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anemec, dkholia, fweimer, hhorak, jorton, ppisar, psabata, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	perl-DBD-MySQL 4.0.37	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-10-13 10:01:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	1381280, 1382016
Bug Blocks:	1380376

Description Adam Mariš 2016-09-29 12:20:42 UTC

A buffer overflow vulnerability in prepared statements that could be possibly triggered by user supplied data was found in perl DBI driver for MySQL. Vulnerability is present in all releases at least back to versions 3.0 of the driver released in 2005.

Comment 1 Adam Mariš 2016-10-03 14:46:32 UTC

Upstream patch:

https://github.com/perl5-dbi/DBD-mysql/commit/7c164a0c86cec6ee95df1d141e67b0e85dfdefd2

Comment 2 Adam Mariš 2016-10-03 14:48:46 UTC

Created perl-DBD-MySQL tracking bugs for this issue:

Affects: fedora-all [bug 1381280]

Comment 8 Dhiru Kholia 2016-10-14 04:54:08 UTC

On RHEL / Fedora, the FORTIFY_SOURCE compilation option catches this stack-based buffer overflow, and it turns a flaw which could result in arbitrary code execution into a mere crash. Our CVSS score reflects this fact.