storage/innobase/dict/dict0crea.c in mysqld in Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (assertion failure) by modifying the (1) innodb_file_format or (2) innodb_file_per_table configuration parameters for the InnoDB storage engine, then executing a DDL statement.

The remote host is affected by the vulnerability described in GLSA-201201-02 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MySQL. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may be able to execute arbitrary code       with the privileges of the MySQL process, cause a Denial of Service       condition, bypass security restrictions, uninstall arbitrary MySQL       plugins, or conduct Man-in-the-Middle and Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been found and corrected in mysql :

storage/innobase/dict/dict0crea.c in mysqld in MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (assertion failure) by modifying the (1) innodb_file_format or (2) innodb_file_per_table configuration parameters for the InnoDB storage engine, then executing a DDL statement (CVE-2010-3676).

MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a join query that uses a table with a unique SET column (CVE-2010-3677).

MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by the WITH ROLLUP modifier (CVE-2010-3678).

MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via certain arguments to the BINLOG command, which triggers an access of uninitialized memory, as demonstrated by valgrind (CVE-2010-3679).

MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by creating temporary tables while using InnoDB, which triggers an assertion failure (CVE-2010-3680).

MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using the HANDLER interface and performing alternate reads from two indexes on a table, which triggers an assertion failure (CVE-2010-3681).

MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using EXPLAIN with crafted 'SELECT ... UNION ... ORDER BY \(SELECT ... WHERE ...\)' statements, which triggers a NULL pointer dereference in the Item_singlerow_subselect::store function (CVE-2010-3682).

MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 sends an OK packet when a LOAD DATA INFILE request generates SQL errors, which allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a crafted request (CVE-2010-3683).

The updated packages have been upgraded to the latest (last) stable 5.1 release (5.1.54) to address these issues for both Mandriva Linux 2010.0 and 2010.2.

Adobe Product Security Incident Response Team reports :

Critical vulnerabilities have been identified in Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player 10.1.95.1 for Android. These vulnerabilities, including CVE-2010-3654 referenced in Security Advisory APSA10-05, could cause the application to crash and could potentially allow an attacker to take control of the affected system.

- local users could delete data files for tables of other     users (CVE-2010-1626).

  - authenticated users could gather information for tables     they should not have access to (CVE-2010-1849)

  - authenticated users could crash mysqld (CVE-2010-1848)

  - authenticated users could potentially execute arbitrary     code as the user running mysqld (CVE-2010-1850)

  - authenticated users could crash mysqld (CVE-2010-3676,     CVE-2010-3677, CVE-2010-3678, CVE-2010-3679,     CVE-2010-3680, CVE-2010-3681, CVE-2010-3682,     CVE-2010-3683, CVE-2010-2008)

  - a race condition in /etc/init.d/mysql allowed local     users to make any file readable via symlink in /var/tmp     (CVE-2010-3675)

Update to mysql 5.1.50, for numerous bug fixes including some low-grade security issues.

See upstream release notes at :

  - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-50.html

    -       http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.htm       l

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL Community Server installed on the remote host is earlier than 5.1.49 and thus potentially affected by multiple vulnerabilities:

  - DDL statements could cause the server to crash. (55039)

  - Joins involving a table with a unique SET column could     cause the server to crash. (54575)

  - Incorrect handling of NULL arguments for IN or CASE     operations involving the WITH ROLLUP modifier could     cause the server to crash. (54477)

  - A malformed argument to the BINLOG statement could     cause the server to crash. (54393)

  - Using TEMPORARY InnoDB tables with nullable columns     could cause the server to crash. (54044)

  - Alternate reads with two indexes on a table using the     HANDLER interface could cause the server to crash.
    (54007)

  - Using EXPLAIN with queries of the form SELECT ... UNION     ... ORDER BY (SELECT ... WHERE ...) could cause the     server to crash. (52711)

  - LOAD DATA INFILE did not check for SQL errors sent and     even if errors were already reported, it sent an OK     packet. Also, an assert was sometimes raised when it     should not have been relating to client-server protocol     checking in debug servers. (52512)

Versions of MySQL Community Server 5.1 earlier than 5.1.49 are potentially affected by multiple vulnerabilities :

  - After changing the values of the 'innodb_file_format' or 'innodb_file_per_table' configuration parameters, DDL statements could cause a server crash. (Bug #55039)

Joins involving a table with a unique SET column could cause a server crash. (Bug #54575)

Incorrect handling of NULL arguments could lead to a crash for IN() or CASE operations when ULL arguments were either passed explicitly as arguments (for IN()) or implicitly generated by the WITH ROLLUP modifier which could lead to a crash. (Bug #54477)

  - A malformed argument to the BINLOG statement could result in Valgrind warnings or a server crash. (Bug #54393)

  - Use of TEMPORARY InnoDB tables with nullabale columns could cause a server crash. (Bug #54044)

  - The server could crash if there were alternate reads from two indexes on a table using the HANDLER interface. (Bug #54007)

  - Using EXPLAIN with specially crafted queries could lead to a crash. (Bug #52711)

  - 'LOAD DATA INFILE' did not check for SQL errors and sent an OK packet even when errors were already reported. (Bug #52512)

ID	Name	Product	Family	Severity
57446	GLSA-201201-02 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
51804	Mandriva Linux Security Advisory : mysql (MDVSA-2011:012)	Nessus	Mandriva Local Security Checks	medium
50505	FreeBSD : linux-flashplugin -- multiple vulnerabilities (76b597e4-e9c6-11df-9e10-001b2134ef46)	Nessus	FreeBSD Local Security Checks	high
50016	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0730-1)	Nessus	SuSE Local Security Checks	medium
49727	Fedora 13 : mysql-5.1.50-2.fc13 (2010-15166)	Nessus	Fedora Local Security Checks	medium
49726	Fedora 14 : mysql-5.1.50-2.fc14 (2010-15147)	Nessus	Fedora Local Security Checks	medium
48759	MySQL Community Server < 5.1.49 Multiple Vulnerabilities	Nessus	Databases	medium
801140	MySQL Community Server 5.1 < 5.1.49 Multiple Denial of Service Vulnerabilities	Log Correlation Engine	Database	medium
5646	MySQL Community Server 5.1 < 5.1.49 Multiple Denial of Service Vulnerabilities	Nessus Network Monitor	Database	medium

Detections

Analytics

CVE-2010-3676

medium

Tenable Plugins

high

medium

high

medium

medium

medium

medium

medium

medium