CVE-2013-1861: Buffer Overflow
Alyssa Milburn reported that when MySQL attempts to convert a binary string representation of a raw geometry object to a textual representation, the length checks in MySQL's spatial functions would overflow, resulting in a crash of mysqld (for instance, a query like "select astext(0x0100000000030000000100000000000010);" will cause the crash).
This has been reported to both upstream MariaDB [1] and Oracle [2]. A proposed patch is available [3].
[1] https://mariadb.atlassian.net/browse/MDEV-4252 [2] http://bugs.mysql.com/bug.php?id=68591 [3] http://lists.askmonty.org/pipermail/commits/2013-March/004371.html
Acknowledgements:
Red Hat would like to thank Alyssa Milburn for reporting this issue.
Other sources
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1861?
CVE-2013-1861 has a high severity rating as it can lead to a crash of the MySQL server.
How do I fix CVE-2013-1861?
To mitigate CVE-2013-1861, upgrade MySQL to version 5.6.12, 5.5.32, or 5.1.70 or higher.
What versions of MySQL are affected by CVE-2013-1861?
CVE-2013-1861 affects MySQL versions below 5.6.12, 5.5.32, and 5.1.70.
Is MariaDB affected by CVE-2013-1861?
Yes, MariaDB versions between 5.5.0 and 5.5.32 and 10.0.0 and 10.0.4 are affected by CVE-2013-1861.
What can happen if CVE-2013-1861 is exploited?
Exploitation of CVE-2013-1861 can cause a crash of the mysqld process, resulting in service disruption.