Bug 555313 (CVE-2009-4484)

Summary: CVE-2009-4484 mysql: yaSSL certificate parsing buffer overflow (vulndisco)
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: byte, patrickm, qe-baseos-daemons, rcvalle, tgl, yjog
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4484
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-01-25 20:08:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Tomas Hoger 2010-01-14 12:22:52 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4484 to the following vulnerability:

Buffer overflow in the server in MySQL 5.0.51a on Linux allows remote attackers
to execute arbitrary code via crafted data to TCP port 3306, as demonstrated by
the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: as of 20100106,
this disclosure has no actionable information. However, because the VulnDisco
Pack author is a reliable researcher, the issue is being assigned a CVE
identifier for tracking purposes. 

References:
http://intevydis.blogspot.com/2010/01/jan-4-2010-mysql-exploit-demo.html
http://intevydis.com/vd-list.shtml
http://isc.sans.org/diary.html?storyid=7900
http://www.securityfocus.com/bid/37640

More details about the issue may be disclosed in about 2 weeks:
http://intevydis.blogspot.com/2010/01/jan-72010-0day-awareness.html

Comment 1 Tom Lane 2010-01-14 14:36:47 UTC
I'm told that this bug is in yassl, which is mysql's private reimplementation of SSL.  Since we don't use that, rather the standard openssl library, this issue doesn't affect any Red Hat build.

Comment 2 Tomas Hoger 2010-01-25 20:08:27 UTC
Additional details and PoC published on Intevydis blog:
  http://intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.html

Upstream commits (5.0 and 5.1 branches):
  http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1
  http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.1/revision/3311.1.3

As mentioned above, MySQL packages in Red Hat Enterprise Linux and Fedora are linked against OpenSSL and not yaSSL.  Affected code is not used.