A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present in the MySQL JDBC Driver version 8.0.19 and JDK version 8u112. The issue is resolved in version 3.46.0.8.

WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.

Our recent paper<https://arxiv.org/pdf/2309.02545.pdf> [AsiaCCS'24] describes a potential vulnerability where stack/register variables can be flipped via fault injection, affecting execution flow in security-sensitive code. There are mitigation strategies you may be interested in incorporating into your code:

Take this vulnerable code, for example:

int auth = 0;

//password check code that sets auth variable

if(auth != 0)

return AUTHSUCCESS;

else

return AUTHFAILURE;

The idea is that any bit can be flipped in auth, and it will result in a mis-authentication. We prove this is a potential vulnerability in OpenSSH, OpenSSL, MySQL, and SUDO. To mitigate this, it is important to have tight logic such that a single-bit flip will not result in unintended execution. For example:

int auth = 0xbe405d1a;

// password check code that sets auth variable to 0x23ab9701 is successful

If(auth == 0x23ab9701)

return AUTHSUCCESS;

else

return AUTHFAILURE;

In this case, the auth variable must be corrupted into the exact authentication pattern, which is fairly improbable.

We issued CVE-2023-42465 for SUDO for this vulnerability.

Here is the patch implemented in v1.9.15.

https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f

Paper link: https://arxiv.org/abs/2309.02545

Caner Tol Worcester Polytechnic Institute https://vernamlab.org<https://vernamlab.org/>

The installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and dev-db/mariadb-galera packages before 2017-09-29 have chown calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to the mysql account for creation of a link.

If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "Post-installation and upgrade tasks" section of the MantisBT Admin Guide), and the MySQL client has a localinfile setting enabled (in php.ini mysqli.allowlocalinfile, or the MySQL client config file, depending on the PHP setup), an attacker may take advantage of MySQL's "connect file read" feature to remotely access files on the MantisBT server.

It was discovered that the mysqldsafe could read ledir value - which specifies the directory where mysqld is stored - from configuration file. This could allow a user with privileges to write to some mysql configuration file - either mysql OS user, or any local OS user able to write to the config via some other way, e.g. by exploiting CVE-2016-6662 - to escalate their privileges to root if mysqldsafe was run with root privileges.

This problem is related to this change applied as part of the CVE-2016-6662 fix:

https://github.com/mysql/mysql-server/commit/684a165f28b3718160a3e4c5ebd18a465d85e97c#diff-144aa2f11374843c969d96b7b84247eaR211

It introduced restriction that mysqld and mysqldversion options can only be specified on the command line and can not be defined in a configuration file. However, such restriction was trivial to bypass while ledir was not restricted in a similar way.

Restriction for ledir was added in MySQL versions 5.5.54, 5.6.35, and 5.7.17. The following related entry can be found in the release notes:

The --ledir option now is accepted only on the command line, not in option files.

http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-35.html http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-17.html

MySQL upstream commit:

https://github.com/mysql/mysql-server/commit/53230ba274a37fa13d65e802c6ef3766cd0c6d91#diff-144aa2f11374843c969d96b7b84247ea

The CVE was made public via Oracle CPU January 2017:

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL

MySQL versions 5.5.52, 5.6.33, and 5.7.15 corrected a flaw in the way error log file was handled by mysqldsafe script. The issue allows mysql system user to escalate their privileges to root, and got two CVE ids assigned - CVE-2016-6664 and CVE-2016-5617 - see bug 1386564.

The original fix was applied as part of the patch for another issue - CVE-2016-6662:

https://github.com/mysql/mysql-server/commit/684a165f28b3718160a3e4c5ebd18a465d85e97c

The fix attempted to prevent script from using touch/chown/chmod on the configured log file if it was a symbolic link. This fix was found to be incomplete and having the following issues:

- Fix was racy, and the race was quite easy to win. Changing ownership and mode of arbitrary files was still possible.

- After the fix, mysqldsafe no longer tried to change ownership or mode of the log file if it was symlink, but it still used the file for logging and written new log entries to it. This allowed arbitrary file corruption, at least.

- It was possible to set log-error to point to arbitrary file, bypassing symlinks checks added by the fix.

These additional problems were corrected in versions 5.5.54, 5.6.35, and 5.7.17:

Unsafe use of rm and chown in mysqldsafe could result in privilege escalation. chown now can be used only when the target directory is /var/log. An incompatible change is that if the directory for the Unix socket file is missing, it is no longer created; instead, an error occurs. Due to these changes, /bin/bash is required to run mysqldsafe on Solaris. /bin/sh is still used on other Unix/Linux platforms.

http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-35.html http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-17.html

via the following commit:

https://github.com/mysql/mysql-server/commit/1f93f4381b60e3a8012ba36a4dec920416073759

This fix, however, effectively disables mysqldsafe's logging to file if the script is running as root.

An unspecified vulnerability in Oracle MySQL Connectors related to the Connector/J component has partial confidentiality impact, partial integrity impact, and no availability impact.

The MySQL client in both MySQL and MariaDB contains a buffer overflow when reading the server version information.

This maybe exploited by connecting to a malicious/compromised db server or by a MITM and potentially allows execution of arbitrary code as the user running the client.

Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.28, has unspecified impact and attack vectors, a different vulnerability than CVE-2013-1492.

Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553.

A vulnerability was found in the handling of password salt values in MySQL. When a user logs into MySQL a salt value is generated that is then used to prevent password guessing attacks (since the salt value must be known in order to send a password). This salt value is created at the start of a session and used for the entire session, once authenticated an attacker can use the MySQL "changeuser" command to attempt to login as a different, as the salt value is known a password guessing attack will be much more efficient.

Reference: http://seclists.org/fulldisclosure/2012/Dec/58

Multiple SQL injection flaws were found in the way the binlog functionality (routines producing events describing database changes such as table creation operations or changes to table data) of MySQL, a multi-user, multi-threaded SQL database server, performed sanitization of table names and other fields prior creating particular log entry. Authorised database users (with privilege to modify tables) could use this flaw to inject arbitrary SQL query into subsequently generated binlog entries.

References: [1] https://mariadb.atlassian.net/browse/MDEV-382

MariaDB patches: [2] http://bazaar.launchpad.net/~maria-captains/maria/5.1/revision/3151.1.1 (against 5.1 branch) [3] http://bazaar.launchpad.net/~maria-captains/maria/5.2/revision/3163.1.1 (against 5.2 branch) [4] http://bazaar.launchpad.net/~maria-captains/maria/5.3/revision/3556.1.2 (against 5.3 branch) [5] http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/3508 (against 5.5 branch)

MySQL bug: [6] http://bugs.mysql.com/66550

MySQL 5.1.x before 5.1.62 and 5.5.x before 5.5.22 allows remote authenticated users to cause a denial of service (assertion failure and mysqld abort) by deleting a record and using HANDLER READ NEXT.

MySQL version 5.5.23 releases notes mention following security fix:

Security Fix: Bug #59533 was fixed.

http://dev.mysql.com/doc/refman/5.5/en/news-5-5-23.html

Upstream bug is currently private and there's no additional info currently available for this issue. The bug is not referenced by any commit in the upstream bazaar repositories.

http://bugs.mysql.com/bug.php?id=59533

MySQL 5.1.x before 5.1.63 and 5.5.x before 5.5.24 allows remote authenticated users to cause a denial of service (mysqld crash) via vectors related to incorrect calculation and a sort order index.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.60 and earlier, and 5.5.19 and earlier, allows remote authenticated users to affect availability, related to MyISAM.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.19 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VulnDisco Pack Professional 9.17. NOTE: as of 20120224, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. NOTE: due to lack of details, it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE.

It was reported [1] that VulnDisco Pack Professional 9.17 contains a working remote 0-day exploit against MySQL 5.5.20. No further information has been provided or is currently available.

Note: Since no further detailed information is currently available about this flaw, Red Hat Security Response Team is actively investigating the progress done on this (both with upstream and the reporter) and will update this record with further information as soon as it is available.

[1] https://lists.immunityinc.com/pipermail/canvas/2012-February/000011.html

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0087 and CVE-2012-0101.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and availability via unknown vectors, a different vulnerability than CVE-2012-0113.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect integrity via unknown vectors.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0119, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and availability via unknown vectors, a different vulnerability than CVE-2012-0118.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect confidentiality via unknown vectors.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, and CVE-2012-0492.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows local users to affect confidentiality and integrity via unknown vectors.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0485, and CVE-2012-0492.