Bug 717686 - mysql: DoS (crash) by performing EXPLAIN for a SELECT from a derived table query in prepared-statement mode (MySQL bug#54488)
Summary: mysql: DoS (crash) by performing EXPLAIN for a SELECT from a derived table qu...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 717721
TreeView+ depends on / blocked
 
Reported: 2011-06-29 15:11 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:45 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-02-14 14:04:27 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2011-06-29 15:11:41 UTC
A NULL pointer derefence flaw was found in the way MySQL server processed certain SQL queries requesting EXPLAIN for a SELECT from a derived table in prepared-statement mode. A remote attacker, valid SQL user could use this flaw to cause denial of service (mysqld daemon crash).

References:
[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html
[2] http://bugs.mysql.com/bug.php?id=54488

Note:
On Red Hat Enterprise Linux systems exploitation of this issue would lead only to temporary denial of service, since mysqld daemon gets automatically restarted upon encountering a crash.

Comment 1 Jan Lieskovsky 2011-06-29 15:13:10 UTC
Public PoC from [2]:
====================

drop table if exists `t1`;
create table `t1`(`a` int)engine=myisam;
insert into `t1` values (1),(1);
prepare `stmt` from 'explain 
select 1 from `t1`
where(select(select 1 from `t1` group by `a`))'; 
execute `stmt` ;

Comment 2 Jan Lieskovsky 2011-06-29 15:15:15 UTC
This issue did NOT affect the version of the mysql package, as shipped with
Red Hat Enterprise Linux 4.

This issue affects the version of the mysql package, as shipped with
Red Hat Enterprise Linux 5.

This issue did NOT affect the version of the mysql package, as shipped with
Red Hat Enterprise Linux 6.

--

This issue did NOT affect the versions of the mysql package, as shipped with
Fedora release of 14 and 15.

Comment 5 Jan Lieskovsky 2012-02-14 14:04:27 UTC
(In reply to comment #2)
> This issue affects the version of the mysql package, as shipped with
> Red Hat Enterprise Linux 5.

The mysql package in Red Hat Enterprise Linux 5 has been upgraded to version 5.0.95 via RHSA-2012:0127 security advisory: https://rhn.redhat.com/errata/RHSA-2012-0127.html, and therefore this issue has been addressed in Red Hat Enterprise Linux 5 too.


Note You need to log in before you can comment on or make changes to this bug.