oss-security - Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 02 Dec 2012 15:53:16 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
CC: Kurt Seifried <kseifried@...hat.com>,
        king cope <isowarez.isowarez.isowarez@...glemail.com>,
        full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
        todd@...ketstormsecurity.org, submit@...sec.com,
        Mitre CVE assign department <cve-assign@...re.org>,
        Steven Christey <coley@...re.org>, security@...iadb.org,
        security@...ql.com, Ritwik Ghoshal <ritwik.ghoshal@...cle.com>,
        moderators@...db.org
Subject: Re: Re: [Full-disclosure] MySQL (Linux) Stack based
 buffer overrun PoC Zeroday

On 12/02/2012 11:30 AM, Kurt Seifried wrote:
> So normally for MySQL issues Oracle would assign the CVE #. However in
> this case we have a bit of a time constraint (it's a weekend and this
> is blowing up quickly)  and the impacts are potentially quite severe.
> So I've spoken with some other Red Hat SRT members and we feel it is
> best to get CVE #'s assigned for these issues quickly so we can refer
> to them properly.
>
> If Oracle security has already assigned CVE's for these please let us
> and the public know so we can use the correct numbers. Also if Oracle
> can let the public know which versions of MySQL are affected (e.g.
> 5.0.x, 5.1.x, 5.5.x, etc.) that would be very helpful to everyone I am
> sure.
>

So here are the CVEs which Kurt meant to assign, but somehow
that mail never reached the lists.


* CVE-2012-5611 MySQL (Linux) Stack based buffer overrun PoC Zeroday
http://seclists.org/fulldisclosure/2012/Dec/4
https://bugzilla.redhat.com/show_bug.cgi?id=882599

* CVE-2012-5612 MySQL (Linux) Heap Based Overrun PoC Zeroday
http://seclists.org/fulldisclosure/2012/Dec/5
https://bugzilla.redhat.com/show_bug.cgi?id=882600

* CVE-2012-5613 MySQL (Linux) Database Privilege Elevation Zeroday
Exploit
http://seclists.org/fulldisclosure/2012/Dec/6
https://bugzilla.redhat.com/show_bug.cgi?id=882606

* CVE-2012-5614 MySQL Denial of Service Zeroday PoC
http://seclists.org/fulldisclosure/2012/Dec/7
https://bugzilla.redhat.com/show_bug.cgi?id=882607

* CVE-2012-5615 MySQL Remote Preauth User Enumeration Zeroday
http://seclists.org/fulldisclosure/2012/Dec/9
https://bugzilla.redhat.com/show_bug.cgi?id=882608


-- 
Huzaifa Sidhpurwala / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.