Bug 919247 – CVE-2013-1861 mysql: geometry query crashes mysqld (CPU July 2013)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 919247 - (CVE-2013-1861) CVE-2013-1861 mysql: geometry query crashes mysqld (CPU July 2013)

Summary:	CVE-2013-1861 mysql: geometry query crashes mysqld (CPU July 2013)

Status:	CLOSED ERRATA

Aliases:	CVE-2013-1861

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20130305,reported=2...
Keywords:	Security

Depends On:	921836 986138 990796 1035870
Blocks:	919250 985658
	Show dependency tree / graph

Reported:	2013-03-07 17:25 EST by Vincent Danen
Modified:	2015-08-19 05:19 EDT (History)
CC List:	5 users (show)

See Also:
Fixed In Version:	mysql 5.6.12, mysql 5.5.32, mysql 5.1.70
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-01-21 01:19:37 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Vincent Danen 2013-03-07 17:25:59 EST

Alyssa Milburn reported that when MySQL attempts to convert a binary string representation of a raw geometry object to a textual representation, the length checks in MySQL's spatial functions would overflow, resulting in a crash of mysqld (for instance, a query like "select astext(0x0100000000030000000100000000000010);" will cause the crash).

This has been reported to both upstream MariaDB [1] and Oracle [2].  A proposed patch is available [3].

[1] https://mariadb.atlassian.net/browse/MDEV-4252
[2] http://bugs.mysql.com/bug.php?id=68591
[3] http://lists.askmonty.org/pipermail/commits/2013-March/004371.html


Acknowledgements:

Red Hat would like to thank Alyssa Milburn for reporting this issue.

Comment 1 Vincent Danen 2013-03-07 17:27:08 EST

No CVE has been assigned; I presume that Oracle will likely end up doing that (hard to tell since their bug is private).

Comment 3 Huzaifa S. Sidhpurwala 2013-03-15 00:52:57 EDT

Mariadb patches:

5.1: http://bazaar.launchpad.net/~maria-captains/maria/5.1/revision/3188
5.5: http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/3682

Comment 5 Huzaifa S. Sidhpurwala 2013-03-15 00:57:30 EDT

Created mysql tracking bugs for this issue

Affects: fedora-all [bug 921836]

Comment 6 Huzaifa S. Sidhpurwala 2013-03-15 02:17:59 EDT

This issue was assigned CVE-2013-1861 via:
http://seclists.org/oss-sec/2013/q1/671

Comment 8 Huzaifa S. Sidhpurwala 2013-03-15 06:21:48 EDT

Statement:

This issue was addressed in the package mysql55-mysql as shipped with Red Hat Enterprise Linux 5 via RHEA-2013:1330. This issue was addressed in the package mysql as shipped with Red Hat Enterprise Linux 6 via RHBA-2013:1647.

Comment 9 Alyssa Milburn 2013-03-18 10:27:47 EDT

See also: http://lists.askmonty.org/pipermail/commits/2013-March/004447.html

Comment 11 Fedora Update System 2013-06-13 02:53:07 EDT

community-mysql-5.5.31-7.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Vincent Danen 2013-07-17 23:24:50 EDT

This issue is noted as being corrected in the Oracle July 2013 CPU:

http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html#AppendixMSQL

It is reported to be fixed in 5.6.12, 5.5.32, and 5.1.70.

Note You need to log in before you can comment on or make changes to this bug.