Oracle MySQL and MariaDB 'acl_get()' Buffer Overflow Vulnerability

Bugtraq ID:	56769
Class:	Boundary Condition Error
CVE:	CVE-2012-5611
Remote:	Yes
Local:	No
Published:	Nov 28 2012 12:00AM
Updated:	May 07 2015 05:07PM
Credit:	Kingcope
Vulnerable:	Ubuntu Ubuntu Linux 12.10 i386 Ubuntu Ubuntu Linux 12.10 amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise Server for VMware 11 SP2 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 11 SP2 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise SDK 11 SP2 SuSE Suse Linux Enterprise Desktop 11 SP2 + Linux kernel 2.6.5 S.u.S.E. openSUSE 12.2 S.u.S.E. openSUSE 12.1 S.u.S.E. openSUSE 11.4 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Redhat Enterprise Linux 5 Server Oracle Mysql 5.5.28 Oracle Mysql 5.5.25 Oracle Mysql 5.5.24 Oracle Mysql 5.5.23 Oracle Mysql 5.5.19 Oracle Mysql 5.1.66 Oracle Mysql 5.1.63 Oracle Mysql 5.1.62 Oracle Mysql 5.1.53 Oracle Enterprise Linux 5 Monty Program Ab MariaDB 5.5.27 Monty Program Ab MariaDB 5.5.25 Monty Program Ab MariaDB 5.5.23 Monty Program Ab MariaDB 5.5.22 Monty Program Ab MariaDB 5.3.8 Monty Program Ab MariaDB 5.3.7 Monty Program Ab MariaDB 5.3.6 Monty Program Ab MariaDB 5.2.12 Monty Program Ab MariaDB 5.2.11 Monty Program Ab MariaDB 5.1.65 Monty Program Ab MariaDB 5.1.62 Monty Program Ab MariaDB 5.1.61 Monty Program Ab MariaDB 5.1.53 Monty Program Ab MariaDB 5.1.51 Monty Program Ab MariaDB 5.1.50 MariaDB MariaDB 5.2.13 MariaDB MariaDB 5.1.66 MariaDB MariaDB 5.5.28a Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6 CentOS CentOS 5
Not Vulnerable:	MariaDB MariaDB 5.5.29 MariaDB MariaDB 5.3.11 MariaDB MariaDB 5.2.13 MariaDB MariaDB 5.1.66 MariaDB MariaDB 5.5.28a

Oracle MySQL and MariaDB 'acl_get()' Buffer Overflow Vulnerability

MySQL and MariaDB are prone to a stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

An authenticated attacker can leverage this issue to execute arbitrary code within the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.

Oracle MySQL and MariaDB 'acl_get()' Buffer Overflow Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/56769.pl

Oracle MySQL and MariaDB 'acl_get()' Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.

Oracle MySQL and MariaDB 'acl_get()' Buffer Overflow Vulnerability

References:

• Buffer overflow in acl_get() (MariaDB)
  
• Bug 881064 - (CVE-2012-5579, CVE-2012-5611) CVE-2012-5611 mysql: acl_get() stack (Red Hat)
  
• MariaDB 5.1.66 Release Notes (Monty Program Ab)
  
• MariaDB 5.2.13 Release Notes (Monty Program Ab)
  
• MariaDB 5.3.11 Release Notes (Monty Program Ab)
  
• MariaDB 5.5.28a Release Notes (Monty Program Ab)
  
• MariaDB Homepage (Monty Program Ab)
  
• MySQL (Linux) Stack based buffer overrun PoC Zeroday (Kingcope)
  
• MySQL Homepage (Oracle)
  
• Oracle Critical Patch Update Advisory - January 2013 (Oracle)