Bug 555313 (CVE-2009-4484) - CVE-2009-4484 mysql: yaSSL certificate parsing buffer overflow (vulndisco)
Summary: CVE-2009-4484 mysql: yaSSL certificate parsing buffer overflow (vulndisco)
Status: CLOSED NOTABUG
Alias: CVE-2009-4484
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://web.nvd.nist.gov/view/vuln/det...
Whiteboard: impact=critical,source=internet,repor...
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-01-14 12:22 UTC by Tomas Hoger
Modified: 2019-06-08 12:54 UTC (History)
6 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2010-01-25 20:08:27 UTC


Attachments (Terms of Use)

Description Tomas Hoger 2010-01-14 12:22:52 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4484 to the following vulnerability:

Buffer overflow in the server in MySQL 5.0.51a on Linux allows remote attackers
to execute arbitrary code via crafted data to TCP port 3306, as demonstrated by
the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: as of 20100106,
this disclosure has no actionable information. However, because the VulnDisco
Pack author is a reliable researcher, the issue is being assigned a CVE
identifier for tracking purposes. 

References:
http://intevydis.blogspot.com/2010/01/jan-4-2010-mysql-exploit-demo.html
http://intevydis.com/vd-list.shtml
http://isc.sans.org/diary.html?storyid=7900
http://www.securityfocus.com/bid/37640

More details about the issue may be disclosed in about 2 weeks:
http://intevydis.blogspot.com/2010/01/jan-72010-0day-awareness.html

Comment 1 Tom Lane 2010-01-14 14:36:47 UTC
I'm told that this bug is in yassl, which is mysql's private reimplementation of SSL.  Since we don't use that, rather the standard openssl library, this issue doesn't affect any Red Hat build.

Comment 2 Tomas Hoger 2010-01-25 20:08:27 UTC
Additional details and PoC published on Intevydis blog:
  http://intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.html

Upstream commits (5.0 and 5.1 branches):
  http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1
  http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.1/revision/3311.1.3

As mentioned above, MySQL packages in Red Hat Enterprise Linux and Fedora are linked against OpenSSL and not yaSSL.  Affected code is not used.


Note You need to log in before you can comment on or make changes to this bug.