Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 476896

Summary: CVE-2008-3963 MySQL: Using an empty binary value leads to server crash
Product: Red Hat Enterprise Linux 5 Reporter: Bryan Mason <bmason>
Component: mysqlAssignee: Tom Lane <tgl>
Status: CLOSED ERRATA QA Contact: BaseOS QE <qe-baseos-auto>
Severity: medium Docs Contact:
Priority: medium    
Version: 5.2CC: byte, hhorak, kvolny, patrickm, sghosh, syeghiay, tao
Target Milestone: rcKeywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-09-02 09:46:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 462071    

Description Bryan Mason 2008-12-17 20:17:33 UTC 
+++ This bug was initially created as a clone of Bug #462071 +++

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-3963 to
the following vulnerability:

MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does
not properly handle a b'' (b single-quote single-quote) token, aka an
empty bit-string literal, which allows remote attackers to cause a
denial of service (daemon crash) by using this token in a SQL
statement.

References:

http://www.openwall.com/lists/oss-security/2008/09/09/4
http://www.openwall.com/lists/oss-security/2008/09/09/7
http://bugs.mysql.com/bug.php?id=35658
http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html
http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html
https://bugs.gentoo.org/237166

--- Additional comment from jlieskov on 2008-09-12 09:00:47 EDT ---

This issue is 64bit architecture specific one. 

Sample test output (mysql-server-5.0.45-7.el5.x86_64):

# service mysqld start
# mysql -u root mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.0.45 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> select b'';
ERROR 2013 (HY000): Lost connection to MySQL server during query

/***** ^-connection crash -^ *****/

mysql> select x'';
ERROR 2006 (HY000): MySQL server has gone away
No connection. Trying to reconnect...
Connection id:    1
Current database: mysql

+-----+
| x'' |
+-----+
|     | 
+-----+
1 row in set (0.00 sec)

--- Additional comment from jlieskov on 2008-09-12 09:03:03 EDT ---

Detail information about (un)affected versions:

This issue DOES NOT affect the versions of the mysql-server package, as
shipped with Red Hat Enteprise Linux 2.1, 3 and 4.
(Unsupported functionality on these versions of the MySQL server).

This issue AFFECTS the versions of the mysql-server package, as shipped
with Red Hat Enterprise Linux 5.1 and within Fedora releases of 8, 9 and 10.
Comment 1 Bryan Mason 2008-12-17 20:18:42 UTC 
Updating priority to match IT ticket.
Comment 8 errata-xmlrpc 2009-09-02 09:46:04 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2009-1289.html