Bug 1399580 – CVE-2016-1251 perl-DBD-MySQL: Use after free when using prepared statements

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1399580 - (CVE-2016-1251) CVE-2016-1251 perl-DBD-MySQL: Use after free when using prepared statements

Summary:	CVE-2016-1251 perl-DBD-MySQL: Use after free when using prepared statements

Status:	NEW

Aliases:	CVE-2016-1251

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20161118,repor...
Keywords:	Security

Depends On:	1405899 1399581
Blocks:	1399583
	Show dependency tree / graph

Reported:	2016-11-29 05:41 EST by Adam Mariš
Modified:	2018-03-29 18:02 EDT (History)
CC List:	9 users (show)

See Also:
Fixed In Version:	perl-DBD-MySQL 4.041
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Adam Mariš 2016-11-29 05:41:15 EST

A use after free vulnerability when using prepared statements was found in DBD::mysql. Function dbd_st_fetch() via Renew() can reallocate output buffer for mysql_stmt_fetch() call, but it does not update pointer to that buffer in imp_sth->stmt structure initialized by mysql_stmt_bind_result() function, which leads to use after free in any mysql function which access imp_sth->stmt structure.

This vulnerability is present in all releases at least back to versions 3.0 of the driver, which were released in 2005.

Upstream patch:

https://github.com/perl5-dbi/DBD-mysql/commit/3619c170461a3107a258d1fd2d00ed4832adb1b1

References:

http://seclists.org/oss-sec/2016/q4/536

Comment 1 Adam Mariš 2016-11-29 05:41:44 EST

Created perl-DBD-MySQL tracking bugs for this issue:

Affects: fedora-all [bug 1399581]

Comment 7 Dhiru Kholia 2017-01-04 00:04:33 EST

Mitigation:

This problem is only exposed when the user uses server-side prepared statement support (mysql_server_prepare=1), which is NOT default behavior and was turned off back for all drivers per MySQL AB decision in 2006 due to issues with server-side prepared statements in the server.

Use the default driver setting which uses emulated prepared statements.

Note You need to log in before you can comment on or make changes to this bug.