CVE-2010-3676: Medium severity MySQL mysql vulnerability

Published Aug 30, 2010

Updated

A denial of service flaw was found in the way MySQL processed multiple parallel connections changing InnoDB storage engine configuration parameters (innodbfileformat and innodbfilepertable) and simultaneously issuing data definition language (DDL) statemens. A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure).

References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html

Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=55039

Other sources

storage/innobase/dict/dict0crea.c in mysqld in Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (assertion failure) by modifying the (1) innodbfileformat or (2) innodbfilepertable configuration parameters for the InnoDB storage engine, then executing a DDL statement.

Affected Software

56 affected components

MySQL mysql=5.1.23

MySQL mysql=5.1.34

MySQL mysql=5.1.37

MySQL mysql=5.1.31

MySQL mysql=5.1.32

MySQL mysql=5.1.5

Oracle MySQL=5.1.39

Oracle MySQL=5.1.40-sp1

Oracle MySQL=5.1.40

Oracle MySQL=5.1.41

Oracle MySQL=5.1.42

Oracle MySQL=5.1.43

Oracle MySQL=5.1.43-sp1

Oracle MySQL=5.1.44

Oracle MySQL=5.1.45

Oracle MySQL=5.1.46-sp1

Oracle MySQL=5.1.46

Oracle MySQL=5.1.47

Oracle MySQL=5.1.48

Oracle MySQL=5.1

Oracle MySQL=5.1.1

Oracle MySQL=5.1.2

Oracle MySQL=5.1.3

Oracle MySQL=5.1.4

Oracle MySQL=5.1.6

Oracle MySQL=5.1.7

Oracle MySQL=5.1.8

Oracle MySQL=5.1.9

Oracle MySQL=5.1.10

Oracle MySQL=5.1.11

Oracle MySQL=5.1.12

Oracle MySQL=5.1.13

Oracle MySQL=5.1.14

Oracle MySQL=5.1.15

Oracle MySQL=5.1.16

Oracle MySQL=5.1.17

Oracle MySQL=5.1.18

Oracle MySQL=5.1.19

Oracle MySQL=5.1.20

Oracle MySQL=5.1.21

Oracle MySQL=5.1.22

Oracle MySQL=5.1.24

Oracle MySQL=5.1.25

Oracle MySQL=5.1.26

Oracle MySQL=5.1.27

Oracle MySQL=5.1.28

Oracle MySQL=5.1.29

Oracle MySQL=5.1.30

Oracle MySQL=5.1.33

Oracle MySQL=5.1.35

Oracle MySQL=5.1.36

Oracle MySQL=5.1.38

Oracle MySQL=5.1.23-a

Oracle MySQL=5.1.31-sp1

Oracle MySQL=5.1.34-sp1

Oracle MySQL=5.1.37-sp1

Event History

Aug 30, 2010

Data Sourced

04:53 PM

DescriptionSeverityAffected Software

Jan 11, 2011

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3676?

CVE-2010-3676 is classified as a denial of service vulnerability affecting specific versions of MySQL.

How do I fix CVE-2010-3676?

To fix CVE-2010-3676, upgrade MySQL to a version that has patched this specific vulnerability.

Which versions of MySQL are affected by CVE-2010-3676?

CVE-2010-3676 affects MySQL versions 5.1.5 through 5.1.49.

What type of attack can exploit CVE-2010-3676?

CVE-2010-3676 can be exploited through multiple parallel connections by authenticated users to cause a denial of service.

Is authentication required to exploit CVE-2010-3676?

Yes, an attacker must be an authenticated MySQL user to exploit CVE-2010-3676.