Bug 596424 – <dev-perl/DBD-mysql-4.37.0: Buffer overflow in error reporting

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2016-10-07 10:23:47 UTC]

From ${URL} :

When a reporting a variable bind error, DBD-mysql would try to
construct the error message in a fixed-size buffer on the stack,
possibly leading to arbitrary code execution.

It depends on the application whether untrusted data is included in
the error message.  -D_FORTIFY_SOURCE=2 would catch this and turn the
issue into a mere crash.

Upstream commit:

  <https://github.com/perl5-dbi/DBD-mysql/commit/7c164a0c86cec6ee95df1d141e67b0e85dfdefd2>

Upstream credits Pali Roh�r with reporting and fixing this issue.

Here is what I used to validate the patch:

use strict;
use warnings;

use DBI;

my $dbh = DBI->connect("DBI:mysql:mysql:",
                       "root", "",
                       { PrintError => 0, RaiseError => 1});

$dbh->do('CREATE TEMPORARY TABLE t (i INTEGER NOT NULL)');
$dbh->begin_work;
my $st = $dbh->prepare('INSERT INTO t VALUES (?)');
$st->bind_param(1, 'X' x 64, DBI::SQL_INTEGER);
$dbh->commit;



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Hanno Böck 2016-10-11 09:11:58 UTC]

This is CVE-2016-1246, more info:
http://blogs.perl.org/users/mike_b/2016/10/security-release---buffer-overflow-in-dbdmysql-perl-library.html

Upstream changelog:
http://cpansearch.perl.org/src/MICHIELB/DBD-mysql-4.037/Changes

This is fixed in 4.37.0, which is already in the tree. Maintainers, can we stabilize that?

[Comment 2 Andreas K. Hüttel 2016-10-22 21:46:56 UTC]

(In reply to Hanno Boeck from comment #1)
> This is CVE-2016-1246, more info:
> http://blogs.perl.org/users/mike_b/2016/10/security-release---buffer-
> overflow-in-dbdmysql-perl-library.html
> 
> Upstream changelog:
> http://cpansearch.perl.org/src/MICHIELB/DBD-mysql-4.037/Changes
> 
> This is fixed in 4.37.0, which is already in the tree. Maintainers, can we
> stabilize that?

Sure. 

Arches please stabilize dev-perl/DBD-mysql-4.37.0
Target: all stable arches

[Comment 3 Agostino Sarubbo 2016-10-26 10:13:02 UTC]

amd64 stable

[Comment 4 Agostino Sarubbo 2016-10-26 10:14:02 UTC]

x86 stable

[Comment 5 Markus Meier 2016-10-26 16:36:03 UTC]

arm stable

[Comment 6 Jeroen Roovers (RETIRED) 2016-11-01 11:02:54 UTC]

Stable for HPPA.

[Comment 7 Jeroen Roovers (RETIRED) 2016-11-04 13:21:19 UTC]

Stable for PPC64.

[Comment 8 Tobias Klausmann (RETIRED) 2016-11-14 14:54:06 UTC]

Stable on alpha.

[Comment 9 Thomas Deutschmann (RETIRED) 2016-11-18 15:28:26 UTC]

Stabilization blocked due to newer bug 600180.

We will do cleanup afterwards.

[Comment 10 GLSAMaker/CVETool Bot 2017-01-23 03:23:20 UTC]

This issue was resolved and addressed in
 GLSA 201701-51 at https://security.gentoo.org/glsa/201701-51
by GLSA coordinator Aaron Bauman (b-man).