CVE-2010-3838
published 2011-01-14CVE-2010-3838: MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a query that…
PriorityP417medium4CVSS 2.0
AVNACLAuSCNINAP
EPSS
3.39%
87.6th percentile
MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with a mixed list of numeric and LONGBLOB arguments, which is not properly handled when the function's result is "processed using an intermediate temporary table."
Affected
126 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
vendor_redhat4.0MEDIUM
vendor_ubuntu3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
MySQL vulnerabilities
vendor_ubuntu·2012-03-12
CVE-2007-5925 MySQL vulnerabilities
Title: MySQL vulnerabilities
Summary: Several security issues were fixed in MySQL.
Multiple security issues were discovered in MySQL and this update includes
new upstream MySQL versions to fix these issues.
MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10,
Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to
MySQL 5.0.95.
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html
http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
MySQL vulnerabilities
vendor_ubuntu·2010-11-11·CVSS 3.5
CVE-2010-2008 [LOW] MySQL vulnerabilities
Title: MySQL vulnerabilities
It was discovered that MySQL incorrectly handled certain requests with the
UPGRADE DATA DIRECTORY NAME command. An authenticated user could exploit
this to make MySQL crash, causing a denial of service. This issue only
affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-2008)
It was discovered that MySQL incorrectly handled joins involving a table
with a unique SET column. An authenticated user could exploit this to make
MySQL crash, causing a denial of service. This issue only affected Ubuntu
6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-3677)
It was discovered that MySQL incorrectly handled NULL arguments to IN() or
CASE operations. An authenticated user could exploit this to make MySQL
crash, causing a denial of service. This issue only affected Ubuntu 9.10
Red Hat
MySQL: crash with LONGBLOB and union or update with subquery (MySQL Bug#54461)
vendor_redhat·2010-06-14·CVSS 4.0
CVE-2010-3838 [MEDIUM] MySQL: crash with LONGBLOB and union or update with subquery (MySQL Bug#54461)
MySQL: crash with LONGBLOB and union or update with subquery (MySQL Bug#54461)
MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with a mixed list of numeric and LONGBLOB arguments, which is not properly handled when the function's result is "processed using an intermediate temporary table."
Package: mysql (Red Hat Enterprise Linux 4) - Not affected
GHSA
GHSA-vp32-m2qc-fv88: MySQL 5
ghsa_unreviewed·2022-05-13
CVE-2010-3838 [MEDIUM] GHSA-vp32-m2qc-fv88: MySQL 5
MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with a mixed list of numeric and LONGBLOB arguments, which is not properly handled when the function's result is "processed using an intermediate temporary table."
No detection rules found.
Exploit-DB
eIQNetworks ESA - Topology DELETEDEVICE Overflow (Metasploit)
exploitdb·2010-09-20
CVE-2006-3838 eIQNetworks ESA - Topology DELETEDEVICE Overflow (Metasploit)
eIQNetworks ESA - Topology DELETEDEVICE Overflow (Metasploit)
---
##
# $Id: eiqnetworks_esa_topology.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'eIQNetworks ESA Topology DELETEDEVICE Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in eIQnetworks
Enterprise Security Analyzer. During the processing of
long arguments to the DELETEDEVICE command in the Topology
server, a stack-based buffer overflow occurs.
This module has only been tested against ESA v2.1.13.
},
'Author' =>
Exploit-DB
eIQNetworks ESA - License Manager LICMGR_ADDLICENSE Overflow (Metasploit)
exploitdb·2010-09-20
CVE-2006-3838 eIQNetworks ESA - License Manager LICMGR_ADDLICENSE Overflow (Metasploit)
eIQNetworks ESA - License Manager LICMGR_ADDLICENSE Overflow (Metasploit)
---
##
# $Id: eiqnetworks_esa.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'eIQNetworks ESA License Manager LICMGR_ADDLICENSE Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in eIQnetworks
Enterprise Security Analyzer. During the processing of
long arguments to the LICMGR_ADDLICENSE command, a stack-based
buffer overflow occurs. This module has only been tested
against ESA v2.1.13.
},
'Author' => [ '
Bugzilla
CVE-2010-3833 CVE-2010-3835 CVE-2010-3836 CVE-2010-3837 CVE-2010-3838 CVE-2010-3839 CVE-2010-3840 mysql various flaws [fedora-12]
bugzilla·2010-10-22·CVSS 5.0
CVE-2010-3833 [MEDIUM] CVE-2010-3833 CVE-2010-3835 CVE-2010-3836 CVE-2010-3837 CVE-2010-3838 CVE-2010-3839 CVE-2010-3840 mysql various flaws [fedora-12]
CVE-2010-3833 CVE-2010-3835 CVE-2010-3836 CVE-2010-3837 CVE-2010-3838 CVE-2010-3839 CVE-2010-3840 mysql various flaws [fedora-12]
fedora-12 tracking bug for mysql: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes
in the 'blocks' bugs.
[bug automatically created by: add-tracking-bugs]
Discussion:
Adding parent bug CVE-2010-3835
New bodhi update url:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=640751,640819
---
Adding parent bug CVE-2010-3836
New bodhi update url:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=640751,640819,640845
---
Adding parent bug CVE-2010-3837, CVE-2010-3838, CVE-2010-3839,
CVE-2010-3840
New bodhi update url:
https://admin.fedoraproj
Bugzilla
CVE-2010-3838 MySQL: crash with LONGBLOB and union or update with subquery (MySQL Bug#54461)
bugzilla·2010-10-06·CVSS 4.0
CVE-2010-3838 [MEDIUM] CVE-2010-3838 MySQL: crash with LONGBLOB and union or update with subquery (MySQL Bug#54461)
CVE-2010-3838 MySQL: crash with LONGBLOB and union or update with subquery (MySQL Bug#54461)
A flaw in MySQL versions prior to 5.1.51 [1] was reported [2] that could allow an authenticated user to kill connections to MySQL by creating a query with the GREATEST() or LEAST() functions having a mixed list of numeric and LONGBLOB arguments.
[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html
[2] http://bugs.mysql.com/bug.php?id=54461
This is noted as having been fixed in MySQL 5.1.51, but it does not cause a crash on MySQL 5.0.50 in Fedora 13. It also causes a crash on Red Hat Enterprise Linux 5 (5.0.77) but not Red Hat Enterprise Linux 4 (4.1.22).
Discussion:
This issue has been assigned the name CVE-2010-3838:
http://article.gmane.org/gmane.comp.security.oss.general/3627
---
http://bugs.mysql.com/bug.php?id=54461http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.htmlhttp://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.htmlhttp://dev.mysql.com/doc/refman/5.5/en/news-5-5-6.htmlhttp://lists.apple.com/archives/security-announce/2011//Jun/msg00000.htmlhttp://secunia.com/advisories/42875http://secunia.com/advisories/42936http://support.apple.com/kb/HT4723http://www.debian.org/security/2011/dsa-2143http://www.mandriva.com/security/advisories?name=MDVSA-2010:222http://www.mandriva.com/security/advisories?name=MDVSA-2010:223http://www.redhat.com/support/errata/RHSA-2010-0825.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0164.htmlhttp://www.securityfocus.com/bid/43676http://www.turbolinux.co.jp/security/2011/TLSA-2011-3j.txthttp://www.ubuntu.com/usn/USN-1017-1http://www.ubuntu.com/usn/USN-1397-1http://www.vupen.com/english/advisories/2011/0105http://www.vupen.com/english/advisories/2011/0170http://www.vupen.com/english/advisories/2011/0345https://bugzilla.redhat.com/show_bug.cgi?id=640858https://exchange.xforce.ibmcloud.com/vulnerabilities/64840http://bugs.mysql.com/bug.php?id=54461http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.htmlhttp://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.htmlhttp://dev.mysql.com/doc/refman/5.5/en/news-5-5-6.htmlhttp://lists.apple.com/archives/security-announce/2011//Jun/msg00000.htmlhttp://secunia.com/advisories/42875http://secunia.com/advisories/42936http://support.apple.com/kb/HT4723http://www.debian.org/security/2011/dsa-2143http://www.mandriva.com/security/advisories?name=MDVSA-2010:222http://www.mandriva.com/security/advisories?name=MDVSA-2010:223http://www.redhat.com/support/errata/RHSA-2010-0825.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0164.htmlhttp://www.securityfocus.com/bid/43676http://www.turbolinux.co.jp/security/2011/TLSA-2011-3j.txthttp://www.ubuntu.com/usn/USN-1017-1http://www.ubuntu.com/usn/USN-1397-1http://www.vupen.com/english/advisories/2011/0105http://www.vupen.com/english/advisories/2011/0170http://www.vupen.com/english/advisories/2011/0345https://bugzilla.redhat.com/show_bug.cgi?id=640858https://exchange.xforce.ibmcloud.com/vulnerabilities/64840
2011-01-14
Published