CVE-2010-3834: Medium severity mysql vulnerability

Published Oct 6, 2010

Updated

A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to kill connections to MySQL, where the server could crash after materializing a derived table that required a temporary table for grouping.

[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html [2] http://bugs.mysql.com/bug.php?id=55568

Other sources

Unspecified vulnerability in MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via vectors related to "materializing a derived table that required a temporary table for grouping" and "user variable assignments."

— MITRE

Affected Software

130 affected components

MySQL mysql=5.1.23

MySQL mysql=5.1.34

MySQL mysql=5.1.37

MySQL mysql=5.1.31

MySQL mysql=5.1.32

MySQL mysql=5.1.5

Oracle MySQL=5.1.39

Oracle MySQL=5.1.40-sp1

Oracle MySQL=5.1.40

Oracle MySQL=5.1.41

Oracle MySQL=5.1.42

Oracle MySQL=5.1.43

Oracle MySQL=5.1.43-sp1

Oracle MySQL=5.1.44

Oracle MySQL=5.1.45

Oracle MySQL=5.1.46-sp1

Oracle MySQL=5.1.46

Oracle MySQL=5.1.47

Oracle MySQL=5.1.48

Oracle MySQL=5.1.49-sp1

Oracle MySQL=5.1.49

Oracle MySQL=5.1.50

Oracle MySQL=5.1

Oracle MySQL=5.1.1

Oracle MySQL=5.1.2

Oracle MySQL=5.1.3

Oracle MySQL=5.1.4

Oracle MySQL=5.1.6

Oracle MySQL=5.1.7

Oracle MySQL=5.1.8

Oracle MySQL=5.1.9

Oracle MySQL=5.1.10

Oracle MySQL=5.1.11

Oracle MySQL=5.1.12

Oracle MySQL=5.1.13

Oracle MySQL=5.1.14

Oracle MySQL=5.1.15

Oracle MySQL=5.1.16

Oracle MySQL=5.1.17

Oracle MySQL=5.1.18

Oracle MySQL=5.1.19

Oracle MySQL=5.1.20

Oracle MySQL=5.1.21

Oracle MySQL=5.1.22

Oracle MySQL=5.1.24

Oracle MySQL=5.1.25

Oracle MySQL=5.1.26

Oracle MySQL=5.1.27

Oracle MySQL=5.1.28

Oracle MySQL=5.1.29

Oracle MySQL=5.1.30

Oracle MySQL=5.1.33

Oracle MySQL=5.1.35

Oracle MySQL=5.1.36

Oracle MySQL=5.1.38

Oracle MySQL=5.1.23-a

Oracle MySQL=5.1.31-sp1

Oracle MySQL=5.1.34-sp1

Oracle MySQL=5.1.37-sp1

Oracle MySQL=5.5.3

Oracle MySQL=5.5.2

Oracle MySQL=5.5.5

Oracle MySQL=5.5.1

Oracle MySQL=5.5.4

Oracle MySQL=5.5.0

MySQL mysql=5.0.5

MySQL mysql=5.0.10

MySQL mysql=5.0.54

MySQL mysql=5.0.0

MySQL mysql=5.0.84

MySQL mysql=5.0.15

MySQL mysql=5.0.17

MySQL mysql=5.0.5.0.21

MySQL mysql=5.0.3

MySQL mysql=5.0.44

MySQL mysql=5.0.66

MySQL mysql=5.0.56

MySQL mysql=5.0.60

MySQL mysql=5.0.24

MySQL mysql=5.0.87

MySQL mysql=5.0.2

MySQL mysql=5.0.22.1.0.1

MySQL mysql=5.0.30

MySQL mysql=5.0.20

MySQL mysql=5.0.1

MySQL mysql=5.0.4

MySQL mysql=5.0.82

MySQL mysql=5.0.36

MySQL mysql=5.0.16

MySQL mysql=5.0.45b

Oracle MySQL=5.0.50

Oracle MySQL=5.0.51

Oracle MySQL=5.0.0-alpha

Oracle MySQL=5.0.3-beta

Oracle MySQL=5.0.6

Oracle MySQL=5.0.11

Oracle MySQL=5.0.12

Oracle MySQL=5.0.13

Oracle MySQL=5.0.14

Oracle MySQL=5.0.18

Oracle MySQL=5.0.19

Oracle MySQL=5.0.21

Oracle MySQL=5.0.22

Oracle MySQL=5.0.23

Oracle MySQL=5.0.25

Oracle MySQL=5.0.26

Oracle MySQL=5.0.27

Oracle MySQL=5.0.30-sp1

Oracle MySQL=5.0.32

Oracle MySQL=5.0.33

Oracle MySQL=5.0.37

Oracle MySQL=5.0.38

Oracle MySQL=5.0.41

Oracle MySQL=5.0.42

Oracle MySQL=5.0.45

Oracle MySQL=5.0.52

Oracle MySQL=5.0.7

Oracle MySQL=5.0.8

Oracle MySQL=5.0.67

Oracle MySQL=5.0.75

Oracle MySQL=5.0.77

Oracle MySQL=5.0.81

Oracle MySQL=5.0.9

Oracle MySQL=5.0.83

Oracle MySQL=5.0.85

Oracle MySQL=5.0.86

Oracle MySQL=5.0.88

Oracle MySQL=5.0.89

Oracle MySQL=5.0.90

Oracle MySQL=5.0.91

Remediation

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=640808

Event History

Oct 6, 2010

Data Sourced

08:17 PM

DescriptionSeverityAffected Software

Jan 14, 2011

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3834?

CVE-2010-3834 has a medium severity rating due to its impact on MySQL server stability.

How do I fix CVE-2010-3834?

To fix CVE-2010-3834, upgrade to MySQL version 5.1.51 or later.

What versions of MySQL are affected by CVE-2010-3834?

CVE-2010-3834 affects MySQL versions prior to 5.1.51.

What impact does CVE-2010-3834 have on MySQL?

CVE-2010-3834 can allow authenticated users to kill MySQL connections, potentially leading to server crashes.

Who can exploit CVE-2010-3834?

Authenticated users with access to the MySQL server can exploit CVE-2010-3834.