oss-security - Re: CVE Request - MySQL

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 21 Nov 2009 21:59:26 +0100
From: Sergei Golubchik <serg@...ql.com>
To: Jan Lieskovsky <jlieskov@...hat.com>
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
  oss-security@...ts.openwall.com, security@...ql.com
Subject: Re: CVE Request - MySQL - 5.0.88

Hi, Jan!

On Nov 21, Jan Lieskovsky wrote:
> Hi Josh, Steve, vendors,
>
> MySQL upstream has released latest 5.0.88 version of their Community
> Server, fixing one security issue:
...
> While the other two (three issues) looks too to be security relevant:
>
> * Error handling was missing for SELECT statements containing
>   subqueries in the WHERE clause and that assigned a SELECT
>   result to a user variable. The server could crash as a result.
>   (Bug#48291: http://bugs.mysql.com/48291)
>
> This looks to be from adjacent network exploitable mysqld DoS.

Yes.

> * If the first argument to GeomFromWKB() function was a geometry
>   value, the function just returned its value. However, it
>   failed to preserve the argument's null_value flag, which
>   caused an unexpected NULL value to be returned to the caller,
>   resulting in a server crash.
>   (Bug#47780: http://bugs.mysql.com/47780)
>
> Same case as the above

Yes.

> * Failure to treat BIT values as unsigned could lead to
>   unpredictable results.
>  (Bug#42803: http://bugs.mysql.com/42803)
>
> Also this one seems to be security related - upstream bug speaks about
> invalid memory access and didn't check the code if this could lead to
> heap overflow once the comparison fails.


No, looks safe. It reads one byte and thinks it's a bool:

class Field_num ... { ...
   bool unsigned_flag;

while it's  somewhere in the middle of a pointer:

class Field_bit ... { ...
   uchar *bit_ptr;

The worst that can happen - MySQL could think the value is signed (BIT
values are always unsigned) and during the optimization phase won't
notice that the condition like "unsigned_value > negative_number" is
always true. Not a big deal.

Regards / Mit vielen Grüßen,
Sergei

-- 
   __  ___     ___ ____  __
  /  |/  /_ __/ __/ __ \/ /   Sergei Golubchik <serg@....com>
 / /|_/ / // /\ \/ /_/ / /__  Principal Software Engineer/Server Architect
/_/  /_/\_, /___/\___\_\___/  Sun Microsystems GmbH, HRB München 161028
       <___/                  Sonnenallee 1, 85551 Kirchheim-Heimstetten
Geschäftsführer: Thomas Schroeder, Wolfgang Engels, Wolf Frenkel
Vorsitzender des Aufsichtsrates: Martin Häring

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.