Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4484 to the following vulnerability: Buffer overflow in the server in MySQL 5.0.51a on Linux allows remote attackers to execute arbitrary code via crafted data to TCP port 3306, as demonstrated by the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. References: http://intevydis.blogspot.com/2010/01/jan-4-2010-mysql-exploit-demo.html http://intevydis.com/vd-list.shtml http://isc.sans.org/diary.html?storyid=7900 http://www.securityfocus.com/bid/37640 More details about the issue may be disclosed in about 2 weeks: http://intevydis.blogspot.com/2010/01/jan-72010-0day-awareness.html
I'm told that this bug is in yassl, which is mysql's private reimplementation of SSL. Since we don't use that, rather the standard openssl library, this issue doesn't affect any Red Hat build.
Additional details and PoC published on Intevydis blog: http://intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.html Upstream commits (5.0 and 5.1 branches): http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1 http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.1/revision/3311.1.3 As mentioned above, MySQL packages in Red Hat Enterprise Linux and Fedora are linked against OpenSSL and not yaSSL. Affected code is not used.