CVE-2010-3833: Medium severity mysql vulnerability

Published Oct 6, 2010

Updated

A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to kill connections to MySQL. During evaluation of arguments to extreme-value functions (such as LEAST() and GREATEST()), type errors did not propagate properly, causing the server to crash, and any other connections to the server to be terminated.

[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html [2] http://bugs.mysql.com/bug.php?id=55826

Other sources

MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 does not properly propagate type errors, which allows remote attackers to cause a denial of service (server crash) via crafted arguments to extreme-value functions such as (1) LEAST and (2) GREATEST, related to KILLBADDATA and a "CREATE TABLE ... SELECT."

— MITRE

Affected Software

130 affected components

MySQL mysql=5.1.23

MySQL mysql=5.1.34

MySQL mysql=5.1.37

MySQL mysql=5.1.31

MySQL mysql=5.1.32

MySQL mysql=5.1.5

Oracle MySQL=5.1.39

Oracle MySQL=5.1.40-sp1

Oracle MySQL=5.1.40

Oracle MySQL=5.1.41

Oracle MySQL=5.1.42

Oracle MySQL=5.1.43

Oracle MySQL=5.1.43-sp1

Oracle MySQL=5.1.44

Oracle MySQL=5.1.45

Oracle MySQL=5.1.46-sp1

Oracle MySQL=5.1.46

Oracle MySQL=5.1.47

Oracle MySQL=5.1.48

Oracle MySQL=5.1.49-sp1

Oracle MySQL=5.1.49

Oracle MySQL=5.1.50

Oracle MySQL=5.1

Oracle MySQL=5.1.1

Oracle MySQL=5.1.2

Oracle MySQL=5.1.3

Oracle MySQL=5.1.4

Oracle MySQL=5.1.6

Oracle MySQL=5.1.7

Oracle MySQL=5.1.8

Oracle MySQL=5.1.9

Oracle MySQL=5.1.10

Oracle MySQL=5.1.11

Oracle MySQL=5.1.12

Oracle MySQL=5.1.13

Oracle MySQL=5.1.14

Oracle MySQL=5.1.15

Oracle MySQL=5.1.16

Oracle MySQL=5.1.17

Oracle MySQL=5.1.18

Oracle MySQL=5.1.19

Oracle MySQL=5.1.20

Oracle MySQL=5.1.21

Oracle MySQL=5.1.22

Oracle MySQL=5.1.24

Oracle MySQL=5.1.25

Oracle MySQL=5.1.26

Oracle MySQL=5.1.27

Oracle MySQL=5.1.28

Oracle MySQL=5.1.29

Oracle MySQL=5.1.30

Oracle MySQL=5.1.33

Oracle MySQL=5.1.35

Oracle MySQL=5.1.36

Oracle MySQL=5.1.38

Oracle MySQL=5.1.23-a

Oracle MySQL=5.1.31-sp1

Oracle MySQL=5.1.34-sp1

Oracle MySQL=5.1.37-sp1

Oracle MySQL=5.5.3

Oracle MySQL=5.5.2

Oracle MySQL=5.5.5

Oracle MySQL=5.5.1

Oracle MySQL=5.5.4

Oracle MySQL=5.5.0

MySQL mysql=5.0.5

MySQL mysql=5.0.10

MySQL mysql=5.0.54

MySQL mysql=5.0.0

MySQL mysql=5.0.84

MySQL mysql=5.0.15

MySQL mysql=5.0.17

MySQL mysql=5.0.5.0.21

MySQL mysql=5.0.3

MySQL mysql=5.0.44

MySQL mysql=5.0.66

MySQL mysql=5.0.56

MySQL mysql=5.0.60

MySQL mysql=5.0.24

MySQL mysql=5.0.87

MySQL mysql=5.0.2

MySQL mysql=5.0.22.1.0.1

MySQL mysql=5.0.30

MySQL mysql=5.0.20

MySQL mysql=5.0.1

MySQL mysql=5.0.4

MySQL mysql=5.0.82

MySQL mysql=5.0.36

MySQL mysql=5.0.16

MySQL mysql=5.0.45b

Oracle MySQL=5.0.50

Oracle MySQL=5.0.51

Oracle MySQL=5.0.0-alpha

Oracle MySQL=5.0.3-beta

Oracle MySQL=5.0.6

Oracle MySQL=5.0.11

Oracle MySQL=5.0.12

Oracle MySQL=5.0.13

Oracle MySQL=5.0.14

Oracle MySQL=5.0.18

Oracle MySQL=5.0.19

Oracle MySQL=5.0.21

Oracle MySQL=5.0.22

Oracle MySQL=5.0.23

Oracle MySQL=5.0.25

Oracle MySQL=5.0.26

Oracle MySQL=5.0.27

Oracle MySQL=5.0.30-sp1

Oracle MySQL=5.0.32

Oracle MySQL=5.0.33

Oracle MySQL=5.0.37

Oracle MySQL=5.0.38

Oracle MySQL=5.0.41

Oracle MySQL=5.0.42

Oracle MySQL=5.0.45

Oracle MySQL=5.0.52

Oracle MySQL=5.0.7

Oracle MySQL=5.0.8

Oracle MySQL=5.0.67

Oracle MySQL=5.0.75

Oracle MySQL=5.0.77

Oracle MySQL=5.0.81

Oracle MySQL=5.0.9

Oracle MySQL=5.0.83

Oracle MySQL=5.0.85

Oracle MySQL=5.0.86

Oracle MySQL=5.0.88

Oracle MySQL=5.0.89

Oracle MySQL=5.0.90

Oracle MySQL=5.0.91

Remediation

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=640751

Event History

Oct 6, 2010

Data Sourced

06:36 PM

DescriptionSeverityAffected Software

Jan 14, 2011

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3833?

CVE-2010-3833 is classified as a medium severity vulnerability that can cause MySQL server crashes.

How do I fix CVE-2010-3833?

To fix CVE-2010-3833, upgrade your MySQL server to version 5.1.51 or higher.

What versions of MySQL are affected by CVE-2010-3833?

CVE-2010-3833 affects MySQL versions prior to 5.1.51.

What type of vulnerability is CVE-2010-3833?

CVE-2010-3833 is a denial-of-service vulnerability that can be exploited by authenticated users.

Can CVE-2010-3833 be exploited remotely?

No, CVE-2010-3833 requires authenticated access to the MySQL server to be exploited.