CVE-2012-4414: SQL Injection

Q: What is the severity of CVE-2012-4414?

CVE-2012-4414 is categorized as a high severity vulnerability due to the potential for unauthorized access to database information via SQL injection.

Q: How do I fix CVE-2012-4414?

To remediate CVE-2012-4414, upgrade to a version of MySQL that has mitigated this vulnerability, specifically versions later than 5.5.28 and 5.1.63.

Q: What types of vulnerabilities are associated with CVE-2012-4414?

CVE-2012-4414 is associated with SQL injection vulnerabilities, which allow an attacker to manipulate SQL queries.

Q: Which software versions are affected by CVE-2012-4414?

CVE-2012-4414 affects specific MySQL versions from 5.1.51 to 5.5.28 and several MariaDB versions before their respective patches.

Q: Can CVE-2012-4414 lead to data breaches?

Yes, if exploited, CVE-2012-4414 can lead to data breaches by allowing attackers to execute unauthorized SQL commands.

Published Aug 27, 2012

Updated

Multiple SQL injection flaws were found in the way the binlog functionality (routines producing events describing database changes such as table creation operations or changes to table data) of MySQL, a multi-user, multi-threaded SQL database server, performed sanitization of table names and other fields prior creating particular log entry. Authorised database users (with privilege to modify tables) could use this flaw to inject arbitrary SQL query into subsequently generated binlog entries.

References: [1] https://mariadb.atlassian.net/browse/MDEV-382

MariaDB patches: [2] http://bazaar.launchpad.net/~maria-captains/maria/5.1/revision/3151.1.1 (against 5.1 branch) [3] http://bazaar.launchpad.net/~maria-captains/maria/5.2/revision/3163.1.1 (against 5.2 branch) [4] http://bazaar.launchpad.net/~maria-captains/maria/5.3/revision/3556.1.2 (against 5.3 branch) [5] http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/3508 (against 5.5 branch)

MySQL bug: [6] http://bugs.mysql.com/66550

Other sources

Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.

— MITRE

Affected Software

77 affected components

ORACLE MySQL<=5.5.28

ORACLE MySQL=5.1.51

ORACLE MySQL=5.1.52

ORACLE MySQL=5.1.52-sp1

ORACLE MySQL=5.1.53

ORACLE MySQL=5.1.54

ORACLE MySQL=5.1.55

ORACLE MySQL=5.1.56

ORACLE MySQL=5.1.57

ORACLE MySQL=5.1.58

ORACLE MySQL=5.1.59

ORACLE MySQL=5.1.60

ORACLE MySQL=5.1.61

ORACLE MySQL=5.1.62

ORACLE MySQL=5.1.63

ORACLE MySQL=5.1.64

ORACLE MySQL=5.1.65

ORACLE MySQL=5.1.66

ORACLE MySQL=5.1.67

ORACLE MySQL=5.5.10

ORACLE MySQL=5.5.11

ORACLE MySQL=5.5.12

ORACLE MySQL=5.5.13

ORACLE MySQL=5.5.14

ORACLE MySQL=5.5.15

ORACLE MySQL=5.5.16

ORACLE MySQL=5.5.17

ORACLE MySQL=5.5.18

ORACLE MySQL=5.5.19

ORACLE MySQL=5.5.20

ORACLE MySQL=5.5.21

ORACLE MySQL=5.5.22

ORACLE MySQL=5.5.23

ORACLE MySQL=5.5.24

ORACLE MySQL=5.5.25

ORACLE MySQL=5.5.25-a

ORACLE MySQL=5.5.26

ORACLE MySQL=5.5.27

MariaDB MariaDB=5.1.41

MariaDB MariaDB=5.1.42

MariaDB MariaDB=5.1.44

MariaDB MariaDB=5.1.47

MariaDB MariaDB=5.1.49

MariaDB MariaDB=5.1.50

MariaDB MariaDB=5.1.51

MariaDB MariaDB=5.1.53

MariaDB MariaDB=5.1.55

MariaDB MariaDB=5.1.60

MariaDB MariaDB=5.1.61

MariaDB MariaDB=5.1.62

MariaDB MariaDB=5.2.0

MariaDB MariaDB=5.2.1

MariaDB MariaDB=5.2.2

MariaDB MariaDB=5.2.3

MariaDB MariaDB=5.2.4

MariaDB MariaDB=5.2.5

MariaDB MariaDB=5.2.6

MariaDB MariaDB=5.2.7

MariaDB MariaDB=5.2.8

MariaDB MariaDB=5.2.9

MariaDB MariaDB=5.2.10

MariaDB MariaDB=5.2.11

MariaDB MariaDB=5.2.12

MariaDB MariaDB=5.3.0

MariaDB MariaDB=5.3.1

MariaDB MariaDB=5.3.2

MariaDB MariaDB=5.3.3

MariaDB MariaDB=5.3.4

MariaDB MariaDB=5.3.5

MariaDB MariaDB=5.3.6

MariaDB MariaDB=5.3.7

MariaDB MariaDB=5.5.20

MariaDB MariaDB=5.5.21

MariaDB MariaDB=5.5.22

MariaDB MariaDB=5.5.23

MariaDB MariaDB=5.5.24

MariaDB MariaDB=5.5.25

Event History

Aug 27, 2012

Data Sourced

05:30 PM

DescriptionSeverityAffected Software

Jan 22, 2013

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-4414?

CVE-2012-4414 is categorized as a high severity vulnerability due to the potential for unauthorized access to database information via SQL injection.

How do I fix CVE-2012-4414?