CVE-2010-3839: Medium severity mysql vulnerability
A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to cause the MySQL server to enter an infinite loop by creating a query with nested JOINs when used from stored procedures and prepared statements.
[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html [2] http://bugs.mysql.com/bug.php?id=53544
This affects MySQL 5.x, but MySQL 4.x and early do not have support for stored procedures. This causes CPU consumption around 95-100%, however connections and queries to the database can continue. Killing the query itself is ineffective, and even a 'service mysqld restart' will fail unless the mysqld process that is handling the query is forcibly killed.
Other sources
MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (infinite loop) via multiple invocations of a (1) prepared statement or (2) stored procedure that creates a query with nested JOIN statements.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3839?
CVE-2010-3839 is considered a moderate severity vulnerability as it can cause a denial of service through an infinite loop.
How do I fix CVE-2010-3839?
To fix CVE-2010-3839, upgrade MySQL to version 5.1.51 or later.
What versions of MySQL are affected by CVE-2010-3839?
CVE-2010-3839 affects MySQL versions prior to 5.1.51, including numerous earlier versions from 5.1.5 to 5.1.50.
Can CVE-2010-3839 be exploited remotely?
CVE-2010-3839 requires an authenticated user to be exploited, as it involves creating specific queries that trigger the vulnerability.
What impact does CVE-2010-3839 have on MySQL databases?
The impact of CVE-2010-3839 is that it can cause the MySQL server to become unresponsive, potentially disrupting service for users.