Bug 600180 (CVE-2016-1249)

Summary:	<dev-perl/DBD-mysql-4.39.0: Out-of-bounds read when using server-side prepared statement support
Product:	Gentoo Security	Reporter:	Thomas Deutschmann (RETIRED) <whissi>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	perl
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://seclists.org/oss-sec/2016/q4/433
Whiteboard:	B3 [glsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	601144
Bug Blocks:	589818, 596424

Description Thomas Deutschmann (RETIRED) gentoo-dev

2016-11-18 15:18:53 UTC

A vulnerability was discovered in perl-DBD-MySQL that can lead to an out-of-bounds read when using server side prepared statements with an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.

This problem is only exposed when the user uses server-side prepared statement support, which is NOT default behavior and was turned off back for all drivers per MySQL AB decision in 2006 due to issues with server-side prepared statements in the server. The behavior of the driver is normally emulated.

Upstream patch:

https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2016-11-18 15:22:06 UTC

A fixed version is already in tree: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=008eb96030a81ed1c5a0a37810097605b15815cf


@maintainer(s): In case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev

2016-11-28 01:48:14 UTC

@ Arches,

please test and mark stable: =dev-perl/DBD-mysql-4.40.0

Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev

2016-11-28 23:33:46 UTC

Stabilization moved to bug 601144.

Comment 4 GLSAMaker/CVETool Bot gentoo-dev

2017-01-23 03:23:28 UTC

This issue was resolved and addressed in
 GLSA 201701-51 at https://security.gentoo.org/glsa/201701-51
by GLSA coordinator Aaron Bauman (b-man).