BID:42625

Oracle MySQL 'LOAD DATA INFILE' Denial Of Service Vulnerability

Info

Oracle MySQL 'LOAD DATA INFILE' Denial Of Service Vulnerability

Bugtraq ID:	42625
Class:	Unknown
CVE:	CVE-2010-3683
Remote:	Yes
Local:	No
Published:	Aug 20 2010 12:00AM
Updated:	Apr 13 2015 09:41PM
Credit:	<br>Elena Stepanova
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise 11 SP1 SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SP3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Pardus Linux 2009 0 MySQL AB MySQL 5.1.48 MySQL AB MySQL 5.1.47 MySQL AB MySQL 5.1.46 MySQL AB MySQL 5.1.45 MySQL AB MySQL 5.1.44 MySQL AB MySQL 5.1.43 MySQL AB MySQL 5.1.42 MySQL AB MySQL 5.1.42 MySQL AB MySQL 5.1.41 MySQL AB MySQL 5.1.39 MySQL AB MySQL 5.1.38 MySQL AB MySQL 5.1.37 MySQL AB MySQL 5.1.36 MySQL AB MySQL 5.1.35 MySQL AB MySQL 5.1.34 MySQL AB MySQL 5.1.33 MySQL AB MySQL 5.1.32 MySQL AB MySQL 5.1.31 MySQL AB MySQL 5.1.30 MySQL AB MySQL 5.1.26 MySQL AB MySQL 5.1.23 MySQL AB MySQL 5.1.22 MySQL AB MySQL 5.1.18 MySQL AB MySQL 5.1.17 MySQL AB MySQL 5.1.16 MySQL AB MySQL 5.1.15 MySQL AB MySQL 5.1.14 MySQL AB MySQL 5.1.13 MySQL AB MySQL 5.1.12 MySQL AB MySQL 5.1.11 MySQL AB MySQL 5.1.10 MySQL AB MySQL 5.1.9 MySQL AB MySQL 5.1.8 MySQL AB MySQL 5.1.6 MySQL AB MySQL 5.1.5 MySQL AB MySQL 5.1.4 MySQL AB MySQL 5.1.3 MySQL AB MySQL 5.1.2 MySQL AB MySQL 5.1.1 8 MySQL AB MySQL 5.0.88 MySQL AB MySQL 5.0.75 MySQL AB MySQL 5.0.66 MySQL AB MySQL 5.0.63 MySQL AB MySQL 5.0.60 MySQL AB MySQL 5.0.52 MySQL AB MySQL 5.0.51 MySQL AB MySQL 5.0.50 MySQL AB MySQL 5.0.49 MySQL AB MySQL 5.0.48 MySQL AB MySQL 5.0.47 MySQL AB MySQL 5.0.46 MySQL AB MySQL 5.0.45 MySQL AB MySQL 5.0.44 MySQL AB MySQL 5.0.42 MySQL AB MySQL 5.0.40 MySQL AB MySQL 5.0.39 MySQL AB MySQL 5.0.38 MySQL AB MySQL 5.0.37 MySQL AB MySQL 5.0.36 MySQL AB MySQL 5.0.33 MySQL AB MySQL 5.0.32 MySQL AB MySQL 5.0.27 MySQL AB MySQL 5.0.26 MySQL AB MySQL 5.0.24 MySQL AB MySQL 5.0.22 -1-0.1 MySQL AB MySQL 5.0.22 MySQL AB MySQL 5.0.21 MySQL AB MySQL 5.0.20 MySQL AB MySQL 5.0.19 MySQL AB MySQL 5.0.18 MySQL AB MySQL 5.0.16 MySQL AB MySQL 5.0.15 MySQL AB MySQL 5.0.14 MySQL AB MySQL 5.0.13 MySQL AB MySQL 5.0.12 MySQL AB MySQL 5.0.11 MySQL AB MySQL 5.0.10 MySQL AB MySQL 5.0.9 MySQL AB MySQL 5.0.8 MySQL AB MySQL 5.0.7 MySQL AB MySQL 5.0.6 MySQL AB MySQL 5.0.5 MySQL AB MySQL 5.0.4 MySQL AB MySQL 5.0.3 MySQL AB MySQL 5.0.2 MySQL AB MySQL 5.0.1 MySQL AB MySQL 5.0 .0-0 MySQL AB MySQL 5.0 MySQL AB MySQL 5.1 MySQL AB MySQL 5.0.51a MySQL AB MySQL 5.0.4A MySQL AB MySQL 5.0.41 MySQL AB MySQL 5.0.3A MySQL AB MySQL 5.0.3 Beta MySQL AB MySQL 5.0.20A MySQL AB MySQL 5.0.1A MySQL AB MySQL 5.0.17A MySQL AB MySQL 5.0.17 MySQL AB MySQL 5.0.16A MySQL AB MySQL 5.0.15A MySQL AB MySQL 5.0.10A MySQL AB MySQL 5.0 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Gentoo Linux

Not Vulnerable:	MySQL AB MySQL 5.1.49

Discussion

Oracle MySQL 'LOAD DATA INFILE' Denial Of Service Vulnerability

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

This issue affects versions prior to MySQL 5.1.49.

NOTE: This issue was previously covered in BID 42594 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been given its own record to better document it.

Exploit / POC

Oracle MySQL 'LOAD DATA INFILE' Denial Of Service Vulnerability

Attackers can exploit this issue using readily available tools.

The following example is available:

/data/vulnerabilities/exploits/42586_52512.txt

Solution / Fix

Oracle MySQL 'LOAD DATA INFILE' Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Ubuntu Ubuntu Linux 9.10 powerpc