| Summary: | <dev-db/mysql-5.1.70 : geometry query crashes mysqld (CVE-2013-1861) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | mysql-bugs |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=919247 | ||
| Whiteboard: | A3 [glsa] | ||
| Package list: | Runtime testing required: | --- | |
Upstream patch as of 2013/03/15 does NOT fix all the issues, see the comments on [1]. 5.5.31 will have further fixes for this. See http://lists.askmonty.org/pipermail/commits/2013-March/004447.html *** Bug 462222 has been marked as a duplicate of this bug. *** CVE-2013-1861 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1861): MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and unspecified versions of Oracle MySQL, allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error. This issue is noted as being corrected in the Oracle July 2013 CPU: http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html#AppendixMSQL It is reported to be fixed in 5.6.12, 5.5.32, and 5.1.70. @security, go ahead with the glsa. GLSA request filed This issue was resolved and addressed in GLSA 201409-04 at http://security.gentoo.org/glsa/glsa-201409-04.xml by GLSA coordinator Sergey Popov (pinkbyte). |
From ${URL} : Alyssa Milburn reported that when MySQL attempts to convert a binary string representation of a raw geometry object to a textual representation, the length checks in MySQL's spatial functions would overflow, resulting in a crash of mysqld (for instance, a query like "select astext(0x0100000000030000000100000000000010);" will cause the crash). This has been reported to both upstream MariaDB [1] and Oracle [2]. A proposed patch is available [3]. [1] https://mariadb.atlassian.net/browse/MDEV-4252 [2] http://bugs.mysql.com/bug.php?id=68591 [3] http://lists.askmonty.org/pipermail/commits/2013-March/004371.html