CVE-2010-3678

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by the WITH ROLLUP modifier.

References

http://bugs.mysql.com/bug.php?id=54477

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html

http://secunia.com/advisories/42936

http://www.mandriva.com/security/advisories?name=MDVSA-2010:155

http://www.mandriva.com/security/advisories?name=MDVSA-2011:012

http://www.openwall.com/lists/oss-security/2010/09/28/10

http://www.redhat.com/support/errata/RHSA-2011-0164.html

http://www.securityfocus.com/bid/42596

http://www.ubuntu.com/usn/USN-1017-1

http://www.ubuntu.com/usn/USN-1397-1

http://www.vupen.com/english/advisories/2011/0133

http://www.vupen.com/english/advisories/2011/0170

https://bugzilla.redhat.com/show_bug.cgi?id=628172

Details

Source: MITRE

Published: 2011-01-11

Updated: 2019-12-17

Type: CWE-399

Risk Information

CVSS v2

Base Score: 4

Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:mysql:mysql:5.1.5:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.1.23:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.1.31:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.1.32:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.1.34:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.1.37:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.7:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.8:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.9:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.10:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.11:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.12:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.13:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.14:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.15:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.16:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.17:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.18:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.19:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.20:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.21:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.22:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.23:a:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.24:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.25:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.26:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.27:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.28:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.29:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.30:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.31:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.33:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.34:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.35:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.36:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.37:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.38:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.39:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.40:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.40:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.41:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.42:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.43:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.43:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.44:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.45:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.46:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.46:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.47:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.48:*:*:*:*:*:*:*

Tenable Plugins

View all (20 total)

IDNameProductFamilySeverity
68184Oracle Linux 6 : mysql (ELSA-2011-0164)NessusOracle Linux Local Security Checks
medium
68134Oracle Linux 5 : mysql (ELSA-2010-0825)NessusOracle Linux Local Security Checks
medium
60940Scientific Linux Security Update : mysql on SL6.x i386/x86_64NessusScientific Linux Local Security Checks
medium
58325Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)NessusUbuntu Local Security Checks
high
57446GLSA-201201-02 : MySQL: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
51804Mandriva Linux Security Advisory : mysql (MDVSA-2011:012)NessusMandriva Local Security Checks
medium
51571RHEL 6 : mysql (RHSA-2011:0164)NessusRed Hat Local Security Checks
medium
50936SuSE 11 / 11.1 Security Update : MySQL (SAT Patch Numbers 3220 / 3243)NessusSuSE Local Security Checks
medium
50806CentOS 5 : mysql (CESA-2010:0825)NessusCentOS Local Security Checks
medium
50573Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1017-1)NessusUbuntu Local Security Checks
medium
50474RHEL 5 : mysql (RHSA-2010:0825)NessusRed Hat Local Security Checks
medium
50021SuSE 10 Security Update : MySQL (ZYPP Patch Number 7172)NessusSuSE Local Security Checks
medium
50016openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0730-1)NessusSuSE Local Security Checks
medium
50010openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0731-1)NessusSuSE Local Security Checks
medium
49727Fedora 13 : mysql-5.1.50-2.fc13 (2010-15166)NessusFedora Local Security Checks
medium
49726Fedora 14 : mysql-5.1.50-2.fc14 (2010-15147)NessusFedora Local Security Checks
medium
48759MySQL Community Server < 5.1.49 Multiple VulnerabilitiesNessusDatabases
medium
801140MySQL Community Server 5.1 < 5.1.49 Multiple Denial of Service VulnerabilitiesLog Correlation EngineDatabase
medium
5646MySQL Community Server 5.1 < 5.1.49 Multiple Denial of Service VulnerabilitiesNessus Network MonitorDatabase
medium
48399Mandriva Linux Security Advisory : mysql (MDVSA-2010:155-1)NessusMandriva Local Security Checks
medium