Bug 896064 (CVE-2013-0386)

Summary:	CVE-2013-0386 mysql: unspecified DoS vulnerability related to Stored Procedure (CPU Jan 2013)
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	byte, hhorak, tgl
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mysql 5.5.29	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-01-17 09:05:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	895568, 895572

Description Jan Lieskovsky 2013-01-16 14:54:35 UTC

An unspecified vulnerability in the stored procedure subcomponent of the MySQL protocol component of the Oracle MySQL server allows remote authenticated attackers to alter availability via unspecified vectors.

References:
[1] http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html

Comment 1 Huzaifa S. Sidhpurwala 2013-01-17 09:05:56 UTC

Text of the Oracle flaw description:

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Stored Procedure). Supported versions that are affected are 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS). 

http://www.oracle.com/technetwork/topics/security/cpujan2013verbose-1897756.html#MSQL

Upstream notes this issue only affected MySQL versions 5.5.  Red Hat Enterprise Linux 5 and 6 include MySQL versions 5.0.x and 5.1.x respectively, which are not listed as affected.  Current Fedora versions are already updated to fixed upstream version.  Closing.

Comment 2 Vincent Danen 2013-01-23 22:08:19 UTC

Statement:

Not vulnerable. Upstream notes this issue only affected MySQL 5.5.x.  Red Hat Enterprise Linux 5 and 6 include MySQL versions 5.0.x and 5.1.x respectively, which are not listed as affected.