Multiple format string vulnerabilities in the dispatchcommand function in libmysqld/sqlparse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COMCREATEDB or (2) COMDROPDB request. NOTE: some of these details are obtained from third party information.

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4484 to the following vulnerability:

Buffer overflow in the server in MySQL 5.0.51a on Linux allows remote attackers to execute arbitrary code via crafted data to TCP port 3306, as demonstrated by the vdmysql5 module in VulnDisco Pack Professional 8.11. NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.

References: http://intevydis.blogspot.com/2010/01/jan-4-2010-mysql-exploit-demo.html http://intevydis.com/vd-list.shtml http://isc.sans.org/diary.html?storyid=7900 http://www.securityfocus.com/bid/37640

More details about the issue may be disclosed in about 2 weeks: http://intevydis.blogspot.com/2010/01/jan-72010-0day-awareness.html

Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) "inputbuffer& operator>>" in yasslimp.cpp.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

The vioverifycallback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

Description of problem:

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-50.html

#

Security Fix: Replication: It was possible when using statement-based replication to subvert the MySQL privilege system on a slave with a higher server release version number than that of the master by using version-specific comments in statements run on the master.

A more detailed explanation follows:

In MySQL, a version-specific comment is an SQL comment of the form /!nnnnn sql / where nnnnn represents a MySQL release version number and sql represents a string of SQL, or a portion of a string of SQL, that should be executed by the MySQL Server only if the server version is at least version n.nn. (For additional information and an example, see Section 8.6, “Comment Syntax”.)

In MySQL replication, the slave SQL thread executes with the SUPER privilege, regardless of the privileges with which statements are originally executed on the master. Specific to this issue, when using statement-based replication it was possible, when the slave was of a higher MySQL version than the master, to run statements that would have failed on the master due to insufficient privileges, except that these statements were wrapped in version-specific comments where the encoded version was greater than the MySQL server version of the master. However, if the MySQL release version of the slave was equal to or greater than the version encoded in the comment, the same statements could execute on this slave whose MySQL release version was less than the version number used in the comment.

Suppose that a master running MySQL 5.1.48 replicated to a slave running MySQL 4.1.49, and that a user user1 had privileges to run UPDATE statements on database db1 but no privileges at all on the mysql system database, so that the first of the following two statements succeeded, but the second statement failed, and thus the first statement was written to the binary log, but the second statement was not:

UPDATE db1.tb1 SET db1.tbl1.col1=2; UPDATE mysql.user SET mysql.user.Superpriv='Y' WHERE mysql.user.User='user1';

However, the text of the second statement could be wrapped in version-specific comments and thus “hidden” within the text of the first statement so that this new version of the first statement succeeded, and was written in its entireity to the binary log. The new statement containing the necessary portions of the statement affecting the “mysql.user” table wrapped within version-specific comments is shown here:

UPDATE db1.tbl1 /!514900 ,mysql.user / SET db1.tbl1.col1=2 /!514900 ,mysql.user.Superpriv='Y' WHERE mysql.user.User='user1'/;

Thus, a 5.1.48 master would see this statement as identical to the first of the original two statements shown previously (UPDATE db1.tb1 SET db1.tbl1.col1=2). However, the version-specific comments within the statement just shown, when run on the MySQL 5.1.49 slave, were ignored; thus the slave SQL thread would execute the statement, as shown here, with the SUPER privilege, on the slave:

UPDATE db1.tbl1,mysql.user SET db1.tbl1.col1=2,mysql.user.Superpriv='Y' WHERE mysql.user.User='user1';

To fix this issue, the ! (exclamation) character is now stripped from comments prior to statements containing them being applied on replication slaves; thus, version-specific comments that are not applied on the master are treated as normal comments on the slave and also not applied there. (Bug#49124)

Version-Release number of selected component (if applicable):

MySQL 5.1.49

How reproducible:

see above

Steps to Reproduce: 1. see above 2. 3. Actual results:

Expected results:

Additional info:

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7247 to the following vulnerability:

sql/sqltable.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink.

References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7247 http://lists.mysql.com/commits/59711 http://marc.info/?l=oss-security&m=125908040022018&w=2 http://bugs.mysql.com/bug.php?id=39277

Upstream patch: --------------- http://lists.mysql.com/commits/59711

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data.

External References:

http://www.oracle.com/security-alerts/cpujul2021.html#AppendixMSQL

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.42 and prior and 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server and unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H).

A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to kill connections to MySQL. During evaluation of arguments to extreme-value functions (such as LEAST() and GREATEST()), type errors did not propagate properly, causing the server to crash, and any other connections to the server to be terminated.

[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html [2] http://bugs.mysql.com/bug.php?id=55826

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.42 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Last updated 24 July 2024

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.42 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

External References:

http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Last updated 24 July 2024

MySQL 4.1.24, 5.0.60, 5.1.24, and 6.0.5 fixes an issue allowing an authenticated attacker to gain privileges to tables that will be created by some other database user in future using MyISAM storage engine, if an attacker can predict names of such tables.

Attacker can create a table using DATA/INDEX DIRECTORY directives causing data and index files (.MYD/.MYI) to be created in some other directory writable by mysql server, including directories used to store table files of other users' databases. If victim later creates table with the same name, attacker's data and index files are overwritten by victim's files, but access privileges are not revoked. Attacker gains access to newly created victim's table.

References: http://bugs.mysql.com/bug.php?id=32167 http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-60.html http://dev.mysql.com/doc/refman/5.1/en/news-5-1-24.html http://dev.mysql.com/doc/refman/6.0/en/news-6-0-5.html

Devin Carraway of the Debian Security Team discovered that the upstream fix for the CVE-2008-2079 is incomplete and still makes it possible for local users to create tables via INDEX/DATA DIRECTORY directives in the MySQL data directory (/var/lib/mysql) via directory symlinks.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25

CVE-2008-2079 was tracked via bug bug #445222.

An attacker needs following to exploit this issue: - MySQL database account with privileges to create tables - shell access to the host running MySQL database with write access to a directory accessible by the mysqld daemon process

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0087 and CVE-2012-0101.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect confidentiality via unknown vectors.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect availability via unknown vectors.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0087 and CVE-2012-0102.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0101 and CVE-2012-0102.

Multiple denial of service flaws were found in MySQL SQL database server. Quoting from upstream 5.0.88 release notes:

Error handling was missing for SELECT statements containing subqueries in the WHERE clause and that assigned a SELECT result to a user variable. The server could crash as a result. (Bug#48291)

If the first argument to GeomFromWKB() function was a geometry value, the function just returned its value. However, it failed to preserve the argument's nullvalue flag, which caused an unexpected NULL value to be returned to the caller, resulting in a server crash. (Bug#47780)

References: ----------- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html (there are more DoS issues mentioned in the release notes, but this CVE was assigned to these two)

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html http://bugs.mysql.com/47780 http://bugs.mysql.com/48291

Upstream patches: ----------------- For Bug #48291 crash with row() operator,select into @var, and subquery returning multiple rows: http://lists.mysql.com/commits/88409 http://lists.mysql.com/commits/88741

For Bug #47780: crash when comparing GIS items from subquery: http://lists.mysql.com/commits/87591 http://lists.mysql.com/commits/88069

A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to kill connections to MySQL. Upstream describes the problem as follows:

IN quantified predicates are never executed directly. They are rather wrapped inside nodes called IN Optimizers (Iteminoptimizer) which take care of the execution. However, this is not done during view preparation. Unfortunately the LIKE predicate pre-evaluates constant right-hand side arguments even during name resolution within view preparation. Likely this is meant as an optimization.

There is a patch for this available [3].

[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html [2] http://bugs.mysql.com/bug.php?id=54568 [3] http://lists.mysql.com/commits/112602

A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to kill connections to MySQL by creating a query with the GREATEST() or LEAST() functions having a mixed list of numeric and LONGBLOB arguments.

[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html [2] http://bugs.mysql.com/bug.php?id=54461

This is noted as having been fixed in MySQL 5.1.51, but it does not cause a crash on MySQL 5.0.50 in Fedora 13. It also causes a crash on Red Hat Enterprise Linux 5 (5.0.77) but not Red Hat Enterprise Linux 4 (4.1.22).

A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to kill connections to MySQL by using GROUPCONCAT() together with 'WITH ROLLUP'.

[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html [2] http://bugs.mysql.com/bug.php?id=54476

This is noted as having been fixed in MySQL 5.1.51, but it does not cause a crash on MySQL 5.0.50 in Fedora 13. It also causes a crash on Red Hat Enterprise Linux 5 (5.0.77) but not Red Hat Enterprise Linux 4 (4.1.22). GROUPCONCAT() support looks to have been added in MySQL 4.1, so Red Hat Enterprise Linux 3 is not affected.

A patch for this flaw is included in the upstream report.

A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to kill connections to MySQL, where the server could crash after materializing a derived table that required a temporary table for grouping.

[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html [2] http://bugs.mysql.com/bug.php?id=55568

MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.