Unspecified vulnerability in MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via vectors related to "materializing a derived table that required a temporary table for grouping" and "user variable assignments."

This update fixes the following security issue :

  - 676974: mysql-cluster: security issues fixed in MySQL     5.1.51

This mysql update fixes the following security issues

  - CVE-2010-3833: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3834: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Insufficient Information     (CWE-noinfo)

  - CVE-2010-3835: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Numeric Errors (CWE-189)

  - CVE-2010-3836: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3837: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3838: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2010-3839: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2010-3840: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

MariaDB was updated to version 5.1.55 to fix numerous bugs and security issues.

This update fixes the following security issue :

  - 676974: mysql-cluster: security issues fixed in MySQL     5.1.51

This update also fixes the following non-security issue :

  - 635645: mysql init script fails to start when SELinux is     enabled

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL installed on the remote host is older than 5.5.6.  As such, it reportedly is prone to multiple denial of service attacks :

  - The improper handling of type errors during argument     evaluation in extreme-value functions, e.g., 'LEAST()'     or 'GREATEST()' causes server crashes. (CVE-2010-3833)

  - Remote authenticated attackers could crash the server.
    (CVE-2010-3834 & CVE-2010-3836)

  - The use of 'GROUP_CONCAT()' and 'WITH ROLLUP' caused     server crashes. (CVE-2010-3837)

  - The use of an intermediate temporary table and queries     containing calls to 'GREATEST()' or 'LEAST()', having     a list of both numeric and 'LONGBLOB' arguments, caused     server crashes. (CVE-2010-3838)

  - The use of nested joins in prepared statements or     stored procedures could result in infinite loops.     (CVE-2010-3839)

The version of MySQL installed on the remote host is older than 5.0.92.  As such, it reportedly is prone to multiple denial of service attacks :

  - The improper handling of type errors during argument     evaluation in extreme-value functions, e.g., 'LEAST()'     or 'GREATEST()' causes server crashes. (CVE-2010-3833)

  - Remote authenticated attackers could crash the server.
    (CVE-2010-3834 & CVE-2010-3836)

  - The use of 'GROUP_CONCAT()' and 'WITH ROLLUP' caused     server crashes. (CVE-2010-3837)

  - The use of an intermediate temporary table and queries     containing calls to 'GREATEST()' or 'LEAST()', having     a list of both numeric and 'LONGBLOB' arguments, caused     server crashes. (CVE-2010-3838)

The remote host is affected by the vulnerability described in GLSA-201201-02 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MySQL. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may be able to execute arbitrary code       with the privileges of the MySQL process, cause a Denial of Service       condition, bypass security restrictions, uninstall arbitrary MySQL       plugins, or conduct Man-in-the-Middle and Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

This MySQL version update to 5.0.94 update fixes the following security issues :

  - CVE-2010-3833: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3834: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Insufficient Information     (CWE-noinfo)

  - CVE-2010-3835: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Numeric Errors (CWE-189)

  - CVE-2010-3836: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3837: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3838: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2010-3839: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2010-3840: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.8. This update contains security-related fixes for the following components :

  - App Store
  - ATS
  - Certificate Trust Policy
  - CoreFoundation
  - CoreGraphics
  - FTP Server
  - ImageIO
  - International Components for Unicode
  - Kernel
  - Libsystem
  - libxslt
  - MobileMe
  - MySQL
  - OpenSSL
  - patch
  - QuickLook
  - QuickTime
  - Samba
  - servermgrd
  - subversion

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-004 applied. This update contains security- related fixes for the following components :

  - AirPort
  - App Store
  - ColorSync
  - CoreGraphics
  - ImageIO
  - Libsystem
  - libxslt
  - MySQL
  - patch
  - Samba
  - servermgrd
  - subversion

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion
IAVA Reference : 2011-A-0160
IAVB Reference : 2012-B-0038
STIG Finding Severity : Category I

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion

Several vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-3677     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     via a join query that uses a table with a unique SET     column.

  - CVE-2010-3680     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     by creating temporary tables while using InnoDB, which     triggers an assertion failure.

  - CVE-2010-3681     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     by using the HANDLER interface and performing 'alternate     reads from two indexes on a table,' which triggers an     assertion failure.

  - CVE-2010-3682     It was discovered that MySQL incorrectly handled use of     EXPLAIN with certain queries. An authenticated user     could crash the server.

  - CVE-2010-3833     It was discovered that MySQL incorrectly handled     propagation during evaluation of arguments to     extreme-value functions. An authenticated user could     crash the server.

  - CVE-2010-3834     It was discovered that MySQL incorrectly handled     materializing a derived table that required a temporary     table for grouping. An authenticated user could crash     the server.

  - CVE-2010-3835     It was discovered that MySQL incorrectly handled certain     user-variable assignment expressions that are evaluated     in a logical expression context. An authenticated user     could crash the server.

  - CVE-2010-3836     It was discovered that MySQL incorrectly handled     pre-evaluation of LIKE predicates during view     preparation. An authenticated user could crash the     server.

  - CVE-2010-3837     It was discovered that MySQL incorrectly handled using     GROUP_CONCAT() and WITH ROLLUP together. An     authenticated user could crash the server.

  - CVE-2010-3838     It was discovered that MySQL incorrectly handled certain     queries using a mixed list of numeric and LONGBLOB     arguments to the GREATEST() or LEAST() functions. An     authenticated user could crash the server.

  - CVE-2010-3840     It was discovered that MySQL incorrectly handled     improper WKB data passed to the PolyFromWKB() function.
    An authenticated user could crash the server.

It was discovered that MySQL incorrectly handled certain requests with the UPGRADE DATA DIRECTORY NAME command. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-2008)

It was discovered that MySQL incorrectly handled joins involving a table with a unique SET column. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS.
(CVE-2010-3677)

It was discovered that MySQL incorrectly handled NULL arguments to IN() or CASE operations. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-3678)

It was discovered that MySQL incorrectly handled malformed arguments to the BINLOG statement. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-3679)

It was discovered that MySQL incorrectly handled the use of TEMPORARY InnoDB tables with nullable columns. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS.
(CVE-2010-3680)

It was discovered that MySQL incorrectly handled alternate reads from two indexes on a table using the HANDLER interface. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-3681)

It was discovered that MySQL incorrectly handled use of EXPLAIN with certain queries. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-3682)

It was discovered that MySQL incorrectly handled error reporting when using LOAD DATA INFILE and would incorrectly raise an assert in certain circumstances. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-3683)

It was discovered that MySQL incorrectly handled propagation during evaluation of arguments to extreme-value functions. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10, 10.04 LTS and 10.10. (CVE-2010-3833)

It was discovered that MySQL incorrectly handled materializing a derived table that required a temporary table for grouping. An authenticated user could exploit this to make MySQL crash, causing a denial of service. (CVE-2010-3834)

It was discovered that MySQL incorrectly handled certain user-variable assignment expressions that are evaluated in a logical expression context. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10, 10.04 LTS and 10.10. (CVE-2010-3835)

It was discovered that MySQL incorrectly handled pre-evaluation of LIKE predicates during view preparation. An authenticated user could exploit this to make MySQL crash, causing a denial of service.
(CVE-2010-3836)

It was discovered that MySQL incorrectly handled using GROUP_CONCAT() and WITH ROLLUP together. An authenticated user could exploit this to make MySQL crash, causing a denial of service. (CVE-2010-3837)

It was discovered that MySQL incorrectly handled certain queries using a mixed list of numeric and LONGBLOB arguments to the GREATEST() or LEAST() functions. An authenticated user could exploit this to make MySQL crash, causing a denial of service. (CVE-2010-3838)

It was discovered that MySQL incorrectly handled queries with nested joins when used from stored procedures and prepared statements. An authenticated user could exploit this to make MySQL hang, causing a denial of service. This issue only affected Ubuntu 9.10, 10.04 LTS and 10.10. (CVE-2010-3839)

It was discovered that MySQL incorrectly handled improper WKB data passed to the PolyFromWKB() function. An authenticated user could exploit this to make MySQL crash, causing a denial of service.
(CVE-2010-3840).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered and corrected in mysql :

  - During evaluation of arguments to extreme-value     functions (such as LEAST() and GREATEST()), type errors     did not propagate properly, causing the server to crash     (CVE-2010-3833).

  - The server could crash after materializing a derived     table that required a temporary table for grouping     (CVE-2010-3834).

  - A user-variable assignment expression that is evaluated     in a logical expression context can be precalculated in     a temporary table for GROUP BY. However, when the     expression value is used after creation of the temporary     table, it was re-evaluated, not read from the table and     a server crash resulted (CVE-2010-3835).

  - Pre-evaluation of LIKE predicates during view     preparation could cause a server crash (CVE-2010-3836).

  - GROUP_CONCAT() and WITH ROLLUP together could cause a     server crash (CVE-2010-3837).

  - Queries could cause a server crash if the GREATEST() or     LEAST() function had a mixed list of numeric and     LONGBLOB arguments, and the result of such a function     was processed using an intermediate temporary table     (CVE-2010-3838).

  - Queries with nested joins could cause an infinite loop     in the server when used from stored procedures and     prepared statements (CVE-2010-3839).

  - The PolyFromWKB() function could crash the server when     improper WKB data was passed to the function     (CVE-2010-3840).

The updated packages have been patched to correct these issues.

Multiple vulnerabilities were discovered and corrected in mysql :

  - Joins involving a table with with a unique SET column     could cause a server crash (CVE-2010-3677).

  - Use of TEMPORARY InnoDB tables with nullable columns     could cause a server crash (CVE-2010-3680).

  - The server could crash if there were alternate reads     from two indexes on a table using the HANDLER interface     (CVE-2010-3681).

  - Using EXPLAIN with queries of the form SELECT ... UNION     ... ORDER BY (SELECT ... WHERE ...) could cause a server     crash (CVE-2010-3682).

  - During evaluation of arguments to extreme-value     functions (such as LEAST() and GREATEST()), type errors     did not propagate properly, causing the server to crash     (CVE-2010-3833).

  - The server could crash after materializing a derived     table that required a temporary table for grouping     (CVE-2010-3834).

  - A user-variable assignment expression that is evaluated     in a logical expression context can be precalculated in     a temporary table for GROUP BY. However, when the     expression value is used after creation of the temporary     table, it was re-evaluated, not read from the table and     a server crash resulted (CVE-2010-3835).

  - Pre-evaluation of LIKE predicates during view     preparation could cause a server crash (CVE-2010-3836).

  - GROUP_CONCAT() and WITH ROLLUP together could cause a     server crash (CVE-2010-3837).

  - Queries could cause a server crash if the GREATEST() or     LEAST() function had a mixed list of numeric and     LONGBLOB arguments, and the result of such a function     was processed using an intermediate temporary table     (CVE-2010-3838).

  - Queries with nested joins could cause an infinite loop     in the server when used from stored procedures and     prepared statements (CVE-2010-3839).

  - The PolyFromWKB() function could crash the server when     improper WKB data was passed to the function     (CVE-2010-3840).

Additionally the default behaviour of using the mysqlmanager instead of the mysqld_safe script has been reverted in the SysV init script because of instability issues with the mysqlmanager.

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been upgraded to mysql 5.0.91 and patched to correct these issues.

Versions of MySQL Community Server 5.1 earlier than 5.1.51 are potentially affected by multiple vulnerabilities :

  - A privilege escalation vulnerability exists when using statement-based replication.  Version specific comments used on a master server with a lesser release version than its slave can allow the MySQL privilege system on the slave server to be subverted. (49124)

  - The improper handling of type errors during argument evaluation in extreme-value functions, e.g., 'LEAST()' or 'GREATEST()' caused server crashes. (55826)

  - The creation of derived tables needing a temporary grouping table caused server crashes. (55568)

  - The re-evaluation of a user-variable assignment expression after the creation of a temporary table caused server crashes. (55564)

  - The pre-evaluation of 'LIKE' predicates while preparing a view caused server crashes. (54568)

  - The use of 'GROUP_CONCAT()' and 'WITH ROLLUP' caused server crashes. (54476)

  - The use of an intermediate temporary table and queries containing calls to 'GREATEST()' or 'LEAST()', having a list of both numeric and 'LONGBLOB' arguments, caused server crashes. (54461)

  - The use of nested joins in prepared statements or stored procedures could result in infinite loops. (53544)

The version of MySQL Community Server installed on the remote host is earlier than 5.1.51 and is, therefore, potentially affected by multiple vulnerabilities:

  - A privilege escalation vulnerability exists when using     statement-based replication. Version specific comments     used on a master server with a lesser release version     than its slave can allow the MySQL privilege system on     the slave server to be subverted. (49124)

  - An authenticated user can crash the MySQL server by     passing improper WKB to the 'PolyFromWKB()' function.
    (51875)

  - The improper handling of type errors during argument     evaluation in extreme-value functions, e.g., 'LEAST()'     or 'GREATEST()' caused server crashes. (55826)

  - The creation of derived tables needing a temporary     grouping table caused server crashes. (55568)

  - The re-evaluation of a user-variable assignment     expression after the creation of a temporary table     caused server crashes. (55564)

  - The 'convert_tz()' function can be used to crash the     server by setting the timezone argument to an empty     SET column value. (55424)

  - The pre-evaluation of 'LIKE' predicates while preparing     a view caused server crashes. (54568)

  - The use of 'GROUP_CONCAT()' and 'WITH ROLLUP' caused     server crashes. (54476)

  - The use of an intermediate temporary table and queries     containing calls to 'GREATEST()' or 'LEAST()', having     a list of both numeric and 'LONGBLOB' arguments, caused     server crashes. (54461)

  - The use of nested joins in prepared statements or     stored procedures could result in infinite loops.
    (53544)

ID	Name	Product	Family	Severity
75905	openSUSE Security Update : libmysqlclusterclient16 (openSUSE-SU-2011:0799-1)	Nessus	SuSE Local Security Checks	medium
75904	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2011:1250-1)	Nessus	SuSE Local Security Checks	medium
75898	openSUSE Security Update : libmariadbclient16 (openSUSE-SU-2011:0743-1)	Nessus	SuSE Local Security Checks	medium
75590	openSUSE Security Update : libmysqlclusterclient16 (openSUSE-SU-2011:0774-1)	Nessus	SuSE Local Security Checks	medium
75589	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2011:1250-1)	Nessus	SuSE Local Security Checks	medium
75582	openSUSE Security Update : libmariadbclient16 (openSUSE-SU-2011:0743-1)	Nessus	SuSE Local Security Checks	medium
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	high
17836	MySQL < 5.5.6 Multiple Denial of Service	Nessus	Databases	medium
17834	MySQL < 5.0.92 Multiple Denial of Service	Nessus	Databases	medium
57446	GLSA-201201-02 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57115	SuSE 11.1 Security Update : MySQL (SAT Patch Number 5285)	Nessus	SuSE Local Security Checks	medium
57114	SuSE 11.1 Security Update : MySQL (SAT Patch Number 5285)	Nessus	SuSE Local Security Checks	medium
55416	Mac OS X 10.6.x < 10.6.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
55415	Mac OS X Multiple Vulnerabilities (Security Update 2011-004)	Nessus	MacOS X Local Security Checks	high
800790	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5968	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
51530	Debian DSA-2143-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
50573	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1017-1)	Nessus	Ubuntu Local Security Checks	medium
50534	Mandriva Linux Security Advisory : mysql (MDVSA-2010:223)	Nessus	Mandriva Local Security Checks	medium
50533	Mandriva Linux Security Advisory : mysql (MDVSA-2010:222)	Nessus	Mandriva Local Security Checks	medium
801142	MySQL Community Server 5.1 < 5.1.51 Multiple Denial of Service Vulnerabilities	Log Correlation Engine	Database	medium
5677	MySQL Community Server 5.1 < 5.1.51 Multiple Denial of Service Vulnerabilities	Nessus Network Monitor	Database	medium
49711	MySQL Community Server < 5.1.51 Multiple Vulnerabilities	Nessus	Databases	medium

Detections

Analytics

CVE-2010-3834

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

medium

high

medium

medium

critical

high

high

critical

medium

medium

medium

medium

medium

medium

medium