CERT-In Vulnerability Note
CIVN-2012-0120
Multiple Vulnerabilities in Oracle MySQL Server
Original Issue Date:December 06, 2012
Severity Rating: HIGH
Systems Affected
- MySQL 5.5.19, 5.1.53 and possibly other versions
- MariaDB 5.5.2x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66
Overview
Multiple vulnerabilities have been reported in Oracle MySQL Server and in MariaDB , which can be exploited by malicious users to cause DoS (Denial of Service) and compromise a vulnerable system to conduct brute force attacks.
Description
1. MySQL (Linux) Stack Based Buffer Overrun Vulnerability
(
CVE-2012-5611
)
This vulnerability exists in MySQL 5.5.19, 5.1.53 & its other versions and in MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66. A remote authenticated user can exploit this vulnerability by passing a long argument to the GRANT FILE command. An attacker who successfully exploits this vulnerability can crash the mysqld.
2. MySQL (Linux) Heap Based Overrun Vulnerability
(
CVE-2012-5612
)
This vulnerability exists in MySQL 5.5.19 & its other versions and in MariaDB 5.5.28a & its other versions. A remote authenticated user can exploit this vulnerability to cause Denial of Service by executing arbitrary code using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands. An attacker who successfully exploits this vulnerability can fire a DoS attack.
3. MySQL (Linux) Database Privilege Elevation Vulnerability
(
CVE-2012-5613
)
This vulnerability exists when MySQL 5.5.19 & its other versions and MariaDB 5.5.28a & its other versions are mis-configured by an administrator while assigning the FILE privilege to non-administrative users. A remote authenticated user can exploit this vulnerability to elevate his permissions to administrative level by leveraging the FILE privilege to create files as MySQL administrator.
4. MySQL Denial of Service Vulnerability
(
CVE-2012-5614
)
This vulnerability exists in MySQL 5.5.19 & its other versions and in MariaDB 5.5.28a & its other versions. A remote authenticated user can exploit this vulnerability by using a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements. An attacker who successfully exploits this vulnerability in MySQL can fire a temporary DoS attack.
5. MySQL Remote Preauth User Enumeration Vulnerability
(
CVE-2012-5615
)
This vulnerability exists in MySQL 5.5.19 & its other versions and in MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, & its other versions. A remote authenticated user can exploit this vulnerability by analysing system-generated error messages and different time delays depending on whether a user name exists or not. An attacker who successfully exploits this vulnerability in MySQL can enumerate valid usernames.
Vendor Information
ORACLE
http://www.oracle.com/us/products/mysql/index.html
http://www.mysql.com/
References
Secunia
http://secunia.com/advisories/51427/
ISC Diary
http://isc.sans.edu/diary.html?storyid=14611
CVE Name
CVE-2012-5611
CVE-2012-5612
CVE-2012-5613
CVE-2012-5614
CVE-2012-5615
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|