CVE-2012-5612
published 2012-12-03CVE-2012-5612: Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote…
PriorityP347medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EXPLOIT
EPSS
20.84%
97.3th percentile
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| mariadb | mariadb | — | — |
| mariadb | mariadb | >= 5.1.0 < 5.1.67 | 5.1.67 |
| mariadb | mariadb | >= 5.2.0 < 5.2.14 | 5.2.14 |
| mariadb | mariadb | >= 5.3.0 < 5.3.12 | 5.3.12 |
| mariadb | mariadb | >= 5.5.0 < 5.5.29 | 5.5.29 |
| oracle | mysql | 5.5.0 – 5.5.28 | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The exploit requires an authenticated database user; monitor for authenticated MySQL sessions issuing rapid repeated variations of DDL/DML commands (USE, SHOW TABLES, DESCRIBE, SHOW FIELDS FROM, SHOW COLUMNS FROM, SHOW INDEX FROM, CREATE TABLE, DROP TABLE, ALTER TABLE, DELETE FROM, UPDATE, SET PASSWORD) in tight loops — characteristic of the PoC fuzzing pattern. ↗
- →The vulnerable code path is in the MDL (Metadata Locking) subsystem, present only in MySQL 5.5 and above; scope detection efforts to MySQL 5.5.x instances (specifically 5.5.19 through 5.5.28) and MariaDB 5.5.28a. ↗
- →The exploit script changes the victim user's password to an undefined value as a side effect; unexpected MySQL user password changes on 5.5.x servers may indicate exploitation attempts. ↗
- →The crash backtrace shows the fault in free_root() called from cleanup()/ha_rollback_trans() chain; mysqld crash reports referencing free_root at my_alloc.c:369 on 5.5.x should be treated as potential exploitation indicators. ↗
- ·The vulnerability only affects MySQL 5.5.x (5.5.19 through 5.5.28) and MariaDB 5.5.28a; MySQL 5.0.x and 5.1.x are NOT affected because the vulnerable MDL subsystem did not exist in those versions. ↗
- ·Exploitation requires a valid authenticated database account; unauthenticated remote exploitation is not possible. ↗
- ·Red Hat Enterprise Linux 5 and 6 ship MySQL 5.0.x and 5.1.x respectively and are confirmed not affected; patched versions are MySQL 5.5.29 and MariaDB fix tracked as MDEV-3908. ↗
CVSS provenance
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
MySQL vulnerabilities
vendor_ubuntu·2013-01-22
CVE-2012-0572 MySQL vulnerabilities
Title: MySQL vulnerabilities
Summary: Several security issues were fixed in MySQL.
Multiple security issues were discovered in MySQL and this update includes
new upstream MySQL versions to fix these issues.
MySQL has been updated to 5.1.67 in Ubuntu 10.04 LTS and Ubuntu 11.10.
Ubuntu 12.04 LTS and Ubuntu 12.10 have been updated to MySQL 5.5.29.
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-67.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-29.html
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
Instructions: In general, a standard system update will make all the necessary
Red Hat
mysql: MDL subsystem heap-based buffer overflow
vendor_redhat·2012-12-01·CVSS 6.5
CVE-2012-5612 [MEDIUM] CWE-122 mysql: MDL subsystem heap-based buffer overflow
mysql: MDL subsystem heap-based buffer overflow
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.
Package: mysql (Red Hat Enterprise Linux 5) - Not affected
Package: mysql (Red Hat Enterprise Linux 6) - Not affected
GHSA
GHSA-j274-98hw-37wv: Heap-based buffer overflow in Oracle MySQL 5
ghsa_unreviewed·2022-05-17
CVE-2012-5612 [MEDIUM] CWE-119 GHSA-j274-98hw-37wv: Heap-based buffer overflow in Oracle MySQL 5
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.
No detection rules found.
Bugzilla
mysql: Oracle CPU January 2013
bugzilla·2013-01-15·CVSS 6.5
CVE-2012-5611 [MEDIUM] mysql: Oracle CPU January 2013
mysql: Oracle CPU January 2013
This bug is for Oracle Critical Patch Update Advisory - January 2013:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
Pre-release of the advisory indicates that it will include 18 CVEs for MySQL, 2 of them remotely exploitable without authentication.
This update is likely to mention previously published issues as CVE-2012-5611 (bug 881064, comment 21) and CVE-2012-5612 (bug 882600).
Discussion:
MySQL risk matrix:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html#AppendixMSQL
Fixes are included in version 5.1.67 and 5.5.29.
Previous CPU for MySQL was released in October 2012 (bug 870399) and covered issues up to versions 5.1.66 and 5.5.28. Hence these are releases since the last CPU:
http://dev.mysql.c
Bugzilla
CVE-2012-5612 mysql: MDL subsystem heap-based buffer overflow
bugzilla·2012-12-02·CVSS 6.5
CVE-2012-5612 [MEDIUM] CVE-2012-5612 mysql: MDL subsystem heap-based buffer overflow
CVE-2012-5612 mysql: MDL subsystem heap-based buffer overflow
A heap-based buffer overflow was found in Mysql. An authenticated database user could use this flaw to cause mysqld to crash or possibly execute arbitrary code with the privileges of the user running mysql.
Reference:
http://seclists.org/fulldisclosure/2012/Dec/5
This issue was assigned CVE-2012-5612
Discussion:
External Reference:
https://mariadb.atlassian.net/browse/MDEV-3908
---
Some other references:
http://www.exploit-db.com/exploits/23076
http://www.openwall.com/lists/oss-security/2012/12/02/3
http://www.openwall.com/lists/oss-security/2012/12/02/4
---
This issue only affect MySQL 5.5 and higher, since the vulnerable MDL subsystem was first implemented in MySQL 5.5:
https://mariadb.atlassian.net/browse/MDEV-3908
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.htmlhttp://seclists.org/fulldisclosure/2012/Dec/5http://secunia.com/advisories/53372http://security.gentoo.org/glsa/glsa-201308-06.xmlhttp://www.exploit-db.com/exploits/23076http://www.mandriva.com/security/advisories?name=MDVSA-2013:102http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.openwall.com/lists/oss-security/2012/12/02/3http://www.openwall.com/lists/oss-security/2012/12/02/4http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.htmlhttp://www.ubuntu.com/usn/USN-1703-1https://mariadb.atlassian.net/browse/MDEV-3908https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16960http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.htmlhttp://seclists.org/fulldisclosure/2012/Dec/5http://secunia.com/advisories/53372http://security.gentoo.org/glsa/glsa-201308-06.xmlhttp://www.exploit-db.com/exploits/23076http://www.mandriva.com/security/advisories?name=MDVSA-2013:102http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.openwall.com/lists/oss-security/2012/12/02/3http://www.openwall.com/lists/oss-security/2012/12/02/4http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.htmlhttp://www.ubuntu.com/usn/USN-1703-1https://mariadb.atlassian.net/browse/MDEV-3908https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16960
2012-12-03
Published