CVE-2010-3837: Use After Free
A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to kill connections to MySQL by using GROUPCONCAT() together with 'WITH ROLLUP'.
[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html [2] http://bugs.mysql.com/bug.php?id=54476
This is noted as having been fixed in MySQL 5.1.51, but it does not cause a crash on MySQL 5.0.50 in Fedora 13. It also causes a crash on Red Hat Enterprise Linux 5 (5.0.77) but not Red Hat Enterprise Linux 4 (4.1.22). GROUPCONCAT() support looks to have been added in MySQL 4.1, so Red Hat Enterprise Linux 3 is not affected.
A patch for this flaw is included in the upstream report.
Other sources
MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a prepared statement that uses GROUPCONCAT with the WITH ROLLUP modifier, probably triggering a use-after-free error when a copied object is modified in a way that also affects the original object.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3837?
CVE-2010-3837 has been classified as a medium severity vulnerability.
How do I fix CVE-2010-3837?
To mitigate the risk of CVE-2010-3837, upgrade to MySQL version 5.1.51 or later.
What versions of MySQL are affected by CVE-2010-3837?
CVE-2010-3837 affects MySQL versions prior to 5.1.51.
Can CVE-2010-3837 be exploited by an unauthenticated user?
No, CVE-2010-3837 can only be exploited by an authenticated user.
What is the impact of exploiting CVE-2010-3837?
The exploitation of CVE-2010-3837 allows an authenticated user to kill existing connections to the MySQL server.