CVE-2010-3678: Medium severity MySQL mysql vulnerability
A denial of service flaw was found in the way MySQL processed SQL queries containing IN or CASE statements, when NULL argument was provided as one of the arguments to the query. A remote MySQL user could use this flaw to cause myqld daemon crash (dereference a NULL pointer).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54477
Upstream changeset: [4] http://lists.mysql.com/commits/111814
Other sources
Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by the WITH ROLLUP modifier.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3678?
CVE-2010-3678 is classified as a denial of service vulnerability that can cause the MySQL daemon to crash.
How do I fix CVE-2010-3678?
To fix CVE-2010-3678, you should upgrade to a patched version of MySQL that is not affected by this vulnerability.
What versions of MySQL are affected by CVE-2010-3678?
CVE-2010-3678 affects multiple versions of MySQL 5.1, including versions 5.1.5 through 5.1.48.
Can CVE-2010-3678 be exploited remotely?
Yes, CVE-2010-3678 can be exploited remotely by a MySQL user through maliciously crafted SQL queries.
What type of attacks does CVE-2010-3678 enable?
CVE-2010-3678 enables attacks that result in denial of service, leading to application downtime.