CVE-2010-3677: Medium severity MySQL mysql vulnerability
A denial of service flaw was found in the way MySQL processed joins queries, which involved a table with unique SET column. A remote MySQL user could use this flaw to cause mysqld daemon crash.
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54575
Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.
Other sources
Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a join query that uses a table with a unique SET column.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3677?
CVE-2010-3677 has been classified as a high severity vulnerability due to its potential to cause a denial of service by crashing the MySQL server.
How do I fix CVE-2010-3677?
To mitigate CVE-2010-3677, users should upgrade to MySQL version 5.1.49 or later where the issue has been addressed.
What software versions are affected by CVE-2010-3677?
CVE-2010-3677 affects multiple MySQL versions up to 5.1.48 inclusive, including specifically versions 5.1.23, 5.1.34, 5.1.37, among others.
What type of attack does CVE-2010-3677 facilitate?
CVE-2010-3677 facilitates a denial of service attack that can crash the mysqld daemon when processing certain complex join queries.
Who can exploit CVE-2010-3677?
Any remote MySQL user can exploit CVE-2010-3677 by crafting specific join queries that trigger the vulnerability.