Bug 1399580 (CVE-2016-1251) - CVE-2016-1251 perl-DBD-MySQL: Use after free when using prepared statements
Summary: CVE-2016-1251 perl-DBD-MySQL: Use after free when using prepared statements
Status: CLOSED WONTFIX
Alias: CVE-2016-1251
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20161118,repor...
Keywords: Security
Depends On: 1405899 1399581
Blocks: 1399583
TreeView+ depends on / blocked
 
Reported: 2016-11-29 10:41 UTC by Adam Mariš
Modified: 2019-06-08 21:36 UTC (History)
9 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2019-06-08 03:02:45 UTC


Attachments (Terms of Use)

Description Adam Mariš 2016-11-29 10:41:15 UTC
A use after free vulnerability when using prepared statements was found in DBD::mysql. Function dbd_st_fetch() via Renew() can reallocate output buffer for mysql_stmt_fetch() call, but it does not update pointer to that buffer in imp_sth->stmt structure initialized by mysql_stmt_bind_result() function, which leads to use after free in any mysql function which access imp_sth->stmt structure.

This vulnerability is present in all releases at least back to versions 3.0 of the driver, which were released in 2005.

Upstream patch:

https://github.com/perl5-dbi/DBD-mysql/commit/3619c170461a3107a258d1fd2d00ed4832adb1b1

References:

http://seclists.org/oss-sec/2016/q4/536

Comment 1 Adam Mariš 2016-11-29 10:41:44 UTC
Created perl-DBD-MySQL tracking bugs for this issue:

Affects: fedora-all [bug 1399581]

Comment 7 Dhiru Kholia 2017-01-04 05:04:33 UTC
Mitigation:

This problem is only exposed when the user uses server-side prepared statement support (mysql_server_prepare=1), which is NOT default behavior and was turned off back for all drivers per MySQL AB decision in 2006 due to issues with server-side prepared statements in the server.

Use the default driver setting which uses emulated prepared statements.


Note You need to log in before you can comment on or make changes to this bug.