BID:37943

MySQL with yaSSL SSL Certificate Handling Remote Stack Buffer Overflow Vulnerability

Info

MySQL with yaSSL SSL Certificate Handling Remote Stack Buffer Overflow Vulnerability

Bugtraq ID:	37943
Class:	Boundary Condition Error
CVE:	CVE-2009-4484
Remote:	Yes
Local:	No
Published:	Jan 25 2010 12:00AM
Updated:	Mar 12 2012 05:00PM
Credit:	<br>Evgeny Legerov
Vulnerable:	yaSSL yaSSL 1.9.6 yaSSL yaSSL 1.7.5 + MySQL AB MySQL 6.0.4 + MySQL AB MySQL 6.0.3 + MySQL AB MySQL 6.0.2 + MySQL AB MySQL 6.0.1 + MySQL AB MySQL 6.0 + MySQL AB MySQL 5.1.23 + MySQL AB MySQL 5.1.22 + MySQL AB MySQL 5.1.18 + MySQL AB MySQL 5.1.17 + MySQL AB MySQL 5.1.16 + MySQL AB MySQL 5.1.15 + MySQL AB MySQL 5.1.14 + MySQL AB MySQL 5.1.13 + MySQL AB MySQL 5.1.12 + MySQL AB MySQL 5.1.11 + MySQL AB MySQL 5.1.10 + MySQL AB MySQL 5.1.9 + MySQL AB MySQL 5.1.6 + MySQL AB MySQL 5.1.5 + MySQL AB MySQL 5.0.52 + MySQL AB MySQL 5.0.51 + MySQL AB MySQL 5.0.50 + MySQL AB MySQL 5.0.49 + MySQL AB MySQL 5.0.48 + MySQL AB MySQL 5.0.47 + MySQL AB MySQL 5.0.46 + MySQL AB MySQL 5.0.45 + MySQL AB MySQL 5.0.45 + MySQL AB MySQL 5.0.44 + MySQL AB MySQL 5.0.42 + MySQL AB MySQL 5.0.40 + MySQL AB MySQL 5.0.39 + MySQL AB MySQL 5.0.38 + MySQL AB MySQL 5.0.37 + MySQL AB MySQL 5.0.36 + MySQL AB MySQL 5.0.33 + MySQL AB MySQL 5.0.32 + MySQL AB MySQL 5.0.27 + MySQL AB MySQL 5.0.24 + MySQL AB MySQL 5.0.22 -1-0.1 + MySQL AB MySQL 5.0.22 + MySQL AB MySQL 5.0.21 + MySQL AB MySQL 5.0.20 + MySQL AB MySQL 5.0.19 + MySQL AB MySQL 5.0.18 yaSSL yaSSL 1.0.6 yaSSL yaSSL 1.0.5 yaSSL yaSSL 1.0.4 yaSSL yaSSL 1.0.3 yaSSL yaSSL 1.0.2 yaSSL yaSSL 1.0.1 yaSSL yaSSL 1.0 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise 10 SP3 SuSE SUSE Linux Enterprise 10 SP2 MySQL AB MySQL 5.5 -ms2 MySQL AB MySQL 5.1.41 MySQL AB MySQL 5.1.39 MySQL AB MySQL 5.1.38 MySQL AB MySQL 5.1.37 MySQL AB MySQL 5.1.36 MySQL AB MySQL 5.1.35 MySQL AB MySQL 5.1.34 MySQL AB MySQL 5.1.33 MySQL AB MySQL 5.1.32 MySQL AB MySQL 5.1.31 MySQL AB MySQL 5.1.30 MySQL AB MySQL 5.1.26 MySQL AB MySQL 5.1.23 MySQL AB MySQL 5.1.22 MySQL AB MySQL 5.1.18 MySQL AB MySQL 5.1.17 MySQL AB MySQL 5.1.16 MySQL AB MySQL 5.1.15 MySQL AB MySQL 5.1.14 MySQL AB MySQL 5.1.13 MySQL AB MySQL 5.1.12 MySQL AB MySQL 5.1.11 MySQL AB MySQL 5.1.10 MySQL AB MySQL 5.1.9 MySQL AB MySQL 5.1.6 MySQL AB MySQL 5.1.5 MySQL AB MySQL 5.0.88 MySQL AB MySQL 5.0.75 MySQL AB MySQL 5.0.66 MySQL AB MySQL 5.0.60 MySQL AB MySQL 5.0.52 MySQL AB MySQL 5.0.51 MySQL AB MySQL 5.0.50 MySQL AB MySQL 5.0.49 MySQL AB MySQL 5.0.48 MySQL AB MySQL 5.0.47 MySQL AB MySQL 5.0.46 MySQL AB MySQL 5.0.45 MySQL AB MySQL 5.0.44 MySQL AB MySQL 5.0.42 MySQL AB MySQL 5.0.40 MySQL AB MySQL 5.0.39 MySQL AB MySQL 5.0.38 MySQL AB MySQL 5.0.37 MySQL AB MySQL 5.0.36 MySQL AB MySQL 5.0.33 MySQL AB MySQL 5.0.32 MySQL AB MySQL 5.0.27 MySQL AB MySQL 5.0.26 MySQL AB MySQL 5.0.24 MySQL AB MySQL 5.0.22 MySQL AB MySQL 5.0.21 MySQL AB MySQL 5.0.20 MySQL AB MySQL 5.0.19 MySQL AB MySQL 5.0.18 MySQL AB MySQL 5.0.4 MySQL AB MySQL 5.0.3 MySQL AB MySQL 5.0.2 MySQL AB MySQL 5.0.1 MySQL AB MySQL 5.0.51a MySQL AB MySQL 5.0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0

Not Vulnerable:	yaSSL yaSSL 1.9.9

Discussion

MySQL with yaSSL SSL Certificate Handling Remote Stack Buffer Overflow Vulnerability

MySQL compiled with yaSSL is prone to a remote stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

MySQL 5.5.0-ms2 is vulnerable when compiled with yaSSL; other versions may also be affected.

Exploit / POC

MySQL with yaSSL SSL Certificate Handling Remote Stack Buffer Overflow Vulnerability

The following examples are available:

/data/vulnerabilities/exploits/37943.py
/data/vulnerabilities/exploits/37943_mysql_yassl_getname.rb

Solution / Fix

MySQL with yaSSL SSL Certificate Handling Remote Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.

Ubuntu Ubuntu Linux 9.10 sparc