Bug 555313 (CVE-2009-4484)

Summary:	CVE-2009-4484 mysql: yaSSL certificate parsing buffer overflow (vulndisco)
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	byte, patrickm, qe-baseos-daemons, rcvalle, tgl, yjog
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4484
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-01-25 20:08:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tomas Hoger 2010-01-14 12:22:52 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4484 to the following vulnerability:

Buffer overflow in the server in MySQL 5.0.51a on Linux allows remote attackers
to execute arbitrary code via crafted data to TCP port 3306, as demonstrated by
the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: as of 20100106,
this disclosure has no actionable information. However, because the VulnDisco
Pack author is a reliable researcher, the issue is being assigned a CVE
identifier for tracking purposes. 

References:
http://intevydis.blogspot.com/2010/01/jan-4-2010-mysql-exploit-demo.html
http://intevydis.com/vd-list.shtml
http://isc.sans.org/diary.html?storyid=7900
http://www.securityfocus.com/bid/37640

More details about the issue may be disclosed in about 2 weeks:
http://intevydis.blogspot.com/2010/01/jan-72010-0day-awareness.html

Comment 1 Tom Lane 2010-01-14 14:36:47 UTC

I'm told that this bug is in yassl, which is mysql's private reimplementation of SSL.  Since we don't use that, rather the standard openssl library, this issue doesn't affect any Red Hat build.

Comment 2 Tomas Hoger 2010-01-25 20:08:27 UTC

Additional details and PoC published on Intevydis blog:
  http://intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.html

Upstream commits (5.0 and 5.1 branches):
  http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1
  http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.1/revision/3311.1.3

As mentioned above, MySQL packages in Red Hat Enterprise Linux and Fedora are linked against OpenSSL and not yaSSL.  Affected code is not used.