CVE-2010-3682: Null Pointer Dereference
A denial of service flaw was found in the way MySQL processed EXPLAIN statements for SQL queries of the form:
SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)
A remote authenticated MySQL user could use this flaw to cause mysqld deamon crash (dereference NULL pointer).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=52711
Upstream changesets: [4] http://lists.mysql.com/commits/105750 [5] http://lists.mysql.com/commits/112043
Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.
Other sources
Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using EXPLAIN with crafted "SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)" statements, which triggers a NULL pointer dereference in the Itemsinglerowsubselect::store function.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3682?
CVE-2010-3682 has been classified as a denial-of-service vulnerability that could lead to a crash of the MySQL daemon.
How do I fix CVE-2010-3682?
To mitigate CVE-2010-3682, it is recommended to upgrade to a fixed version of MySQL that addresses this vulnerability.
Which versions are affected by CVE-2010-3682?
CVE-2010-3682 affects MySQL versions 5.1.1 through 5.1.48, as well as specific higher versions based on the software versioning.
Who can exploit CVE-2010-3682?
A remote authenticated MySQL user can exploit CVE-2010-3682 to cause a denial-of-service condition.
What is the impact of exploiting CVE-2010-3682?
Exploiting CVE-2010-3682 can cause the MySQL server process to crash, resulting in a denial of service.