Bug 919247 (CVE-2013-1861)

Summary:	CVE-2013-1861 mysql: geometry query crashes mysqld (CPU July 2013)
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	Bjorn.Munch, byte, fuzzie, hhorak, kvolny
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mysql 5.6.12, mysql 5.5.32, mysql 5.1.70	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-01-21 06:19:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	921836, 986138, 990796, 1035870
Bug Blocks:	919250, 985658

Description Vincent Danen 2013-03-07 22:25:59 UTC

Alyssa Milburn reported that when MySQL attempts to convert a binary string representation of a raw geometry object to a textual representation, the length checks in MySQL's spatial functions would overflow, resulting in a crash of mysqld (for instance, a query like "select astext(0x0100000000030000000100000000000010);" will cause the crash).

This has been reported to both upstream MariaDB [1] and Oracle [2].  A proposed patch is available [3].

[1] https://mariadb.atlassian.net/browse/MDEV-4252
[2] http://bugs.mysql.com/bug.php?id=68591
[3] http://lists.askmonty.org/pipermail/commits/2013-March/004371.html


Acknowledgements:

Red Hat would like to thank Alyssa Milburn for reporting this issue.

Comment 1 Vincent Danen 2013-03-07 22:27:08 UTC

No CVE has been assigned; I presume that Oracle will likely end up doing that (hard to tell since their bug is private).

Comment 3 Huzaifa S. Sidhpurwala 2013-03-15 04:52:57 UTC

Mariadb patches:

5.1: http://bazaar.launchpad.net/~maria-captains/maria/5.1/revision/3188
5.5: http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/3682

Comment 5 Huzaifa S. Sidhpurwala 2013-03-15 04:57:30 UTC

Created mysql tracking bugs for this issue

Affects: fedora-all [bug 921836]

Comment 6 Huzaifa S. Sidhpurwala 2013-03-15 06:17:59 UTC

This issue was assigned CVE-2013-1861 via:
http://seclists.org/oss-sec/2013/q1/671

Comment 8 Huzaifa S. Sidhpurwala 2013-03-15 10:21:48 UTC

Statement:

This issue was addressed in the package mysql55-mysql as shipped with Red Hat Enterprise Linux 5 via RHEA-2013:1330. This issue was addressed in the package mysql as shipped with Red Hat Enterprise Linux 6 via RHBA-2013:1647.

Comment 9 Alyssa Milburn 2013-03-18 14:27:47 UTC

See also: http://lists.askmonty.org/pipermail/commits/2013-March/004447.html

Comment 11 Fedora Update System 2013-06-13 06:53:07 UTC

community-mysql-5.5.31-7.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Vincent Danen 2013-07-18 03:24:50 UTC

This issue is noted as being corrected in the Oracle July 2013 CPU:

http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html#AppendixMSQL

It is reported to be fixed in 5.6.12, 5.5.32, and 5.1.70.