Several vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-3677     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     via a join query that uses a table with a unique SET     column.

  - CVE-2010-3680     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     by creating temporary tables while using InnoDB, which     triggers an assertion failure.

  - CVE-2010-3681     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     by using the HANDLER interface and performing 'alternate     reads from two indexes on a table,' which triggers an     assertion failure.

  - CVE-2010-3682     It was discovered that MySQL incorrectly handled use of     EXPLAIN with certain queries. An authenticated user     could crash the server.

  - CVE-2010-3833     It was discovered that MySQL incorrectly handled     propagation during evaluation of arguments to     extreme-value functions. An authenticated user could     crash the server.

  - CVE-2010-3834     It was discovered that MySQL incorrectly handled     materializing a derived table that required a temporary     table for grouping. An authenticated user could crash     the server.

  - CVE-2010-3835     It was discovered that MySQL incorrectly handled certain     user-variable assignment expressions that are evaluated     in a logical expression context. An authenticated user     could crash the server.

  - CVE-2010-3836     It was discovered that MySQL incorrectly handled     pre-evaluation of LIKE predicates during view     preparation. An authenticated user could crash the     server.

  - CVE-2010-3837     It was discovered that MySQL incorrectly handled using     GROUP_CONCAT() and WITH ROLLUP together. An     authenticated user could crash the server.

  - CVE-2010-3838     It was discovered that MySQL incorrectly handled certain     queries using a mixed list of numeric and LONGBLOB     arguments to the GREATEST() or LEAST() functions. An     authenticated user could crash the server.

  - CVE-2010-3840     It was discovered that MySQL incorrectly handled     improper WKB data passed to the PolyFromWKB() function.
    An authenticated user could crash the server.

Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

It was found that the MySQL PolyFromWKB() function did not sanity check Well-Known Binary (WKB) data. A remote, authenticated attacker could use specially crafted WKB data to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3840)

A flaw was found in the way MySQL processed certain JOIN queries. If a stored procedure contained JOIN queries, and that procedure was executed twice in sequence, it could cause an infinite loop, leading to excessive CPU use (up to 100%). A remote, authenticated attacker could use this flaw to cause a denial of service. (CVE-2010-3839)

A flaw was found in the way MySQL processed queries that provide a mixture of numeric and longblob data types to the LEAST or GREATEST function. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3838)

A flaw was found in the way MySQL processed PREPARE statements containing both GROUP_CONCAT and the WITH ROLLUP modifier. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3837)

It was found that MySQL did not properly pre-evaluate LIKE arguments in view prepare mode. A remote, authenticated attacker could possibly use this flaw to crash mysqld. (CVE-2010-3836)

A flaw was found in the way MySQL processed statements that assign a value to a user-defined variable and that also contain a logical value evaluation. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3835)

A flaw was found in the way MySQL evaluated the arguments of extreme-value functions, such as LEAST and GREATEST. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3833)

A flaw was found in the way MySQL processed EXPLAIN statements for some complex SELECT queries. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3682)

A flaw was found in the way MySQL processed certain alternating READ requests provided by HANDLER statements. A remote, authenticated attacker could use this flaw to provide such requests, causing mysqld to crash. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3681)

A flaw was found in the way MySQL processed CREATE TEMPORARY TABLE statements that define NULL columns when using the InnoDB storage engine. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3680)

A flaw was found in the way MySQL processed JOIN queries that attempt to retrieve data from a unique SET column. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3677)

All MySQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-485:04 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation     consisting of a server daemon (mysqld) and many different client programs and libraries. The base package     contains the MySQL client programs, the client shared libraries, and generic MySQL files.
    Security issues fixed with this release:
    CVE-2010-3677     CVE-2010-3680     CVE-2010-3681     CVE-2010-3682     CVE-2010-3833     CVE-2010-3835     CVE-2010-3836     CVE-2010-3837     CVE-2010-3838     CVE-2010-3839     CVE-2010-3840     No information available at the time of writing, please see the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL installed on the remote host is older than 5.0.92.  As such, it reportedly is prone to multiple denial of service attacks :

  - The improper handling of type errors during argument     evaluation in extreme-value functions, e.g., 'LEAST()'     or 'GREATEST()' causes server crashes. (CVE-2010-3833)

  - Remote authenticated attackers could crash the server.
    (CVE-2010-3834 & CVE-2010-3836)

  - The use of 'GROUP_CONCAT()' and 'WITH ROLLUP' caused     server crashes. (CVE-2010-3837)

  - The use of an intermediate temporary table and queries     containing calls to 'GREATEST()' or 'LEAST()', having     a list of both numeric and 'LONGBLOB' arguments, caused     server crashes. (CVE-2010-3838)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-32:01 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation     consisting of a server daemon (mysqld) and many different client programs and libraries. The base package     contains the MySQL client programs, the client shared libraries, and generic MySQL files.
    Security issues fixed with this release:
    CVE-2010-3677     Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial     of service (mysqld daemon crash) via a join query that uses a table with a unique SET column.
    CVE-2010-3678     Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via     (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by     the WITH ROLLUP modifier.
    CVE-2010-3679     Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld     daemon crash) via certain arguments to the BINLOG command, which triggers an access of uninitialized     memory, as demonstrated by valgrind.
    CVE-2010-3680     Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld     daemon crash) by creating temporary tables with nullable columns while using InnoDB, which triggers an     assertion failure.
    CVE-2010-3681     Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to cause a denial of     service (mysqld daemon crash) by using the HANDLER interface and performing 'alternate reads from two     indexes on a table,' which triggers an assertion failure.
    CVE-2010-3682     Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial     of service (mysqld daemon crash) by using EXPLAIN with crafted 'SELECT ... UNION ... ORDER BY (SELECT ...
    WHERE ...)' statements, which triggers a NULL pointer dereference in the Item_singlerow_subselect::store     function.
    CVE-2010-3683     Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 sends an OK packet when a LOAD DATA INFILE request     generates SQL errors, which allows remote authenticated users to cause a denial of service (mysqld daemon     crash) via a crafted request.
    CVE-2010-3833     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 does not properly propagate type errors,     which allows remote attackers to cause a denial of service (server crash) via crafted arguments to     extreme-value functions such as (1) LEAST and (2) GREATEST, related to KILL_BAD_DATA and a 'CREATE TABLE     ... SELECT.'     CVE-2010-3835     MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of     service (mysqld server crash) by performing a user-variable assignment in a logical expression that is     calculated and stored in a temporary table for GROUP BY, then causing the expression value to be used     after the table is created, which causes the expression to be re-evaluated instead of accessing its value     from the table.
    CVE-2010-3836     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to     cause a denial of service (assertion failure and server crash) via vectors related to view preparation,     pre-evaluation of LIKE predicates, and IN Optimizers.
    CVE-2010-3837     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to     cause a denial of service (server crash) via a prepared statement that uses GROUP_CONCAT with the WITH     ROLLUP modifier, probably triggering a use-after-free error when a copied object is modified in a way that     also affects the original object.
    CVE-2010-3838     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to     cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with     a mixed list of numeric and LONGBLOB arguments, which is not properly handled when the function's result     is 'processed using an intermediate temporary table.'     CVE-2010-3839     MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of     service (infinite loop) via multiple invocations of a (1) prepared statement or (2) stored procedure that     creates a query with nested JOIN statements.
    CVE-2010-3840     The Gis_line_string::init_from_wkb function in sql/spatial.cc in MySQL 5.1 before 5.1.51 allows remote     authenticated users to cause a denial of service (server crash) by calling the PolyFromWKB function with     Well-Known Binary (WKB) data containing a crafted number of (1) line strings or (2) line points.
    These updated packages upgrade MySQL to version 5.1.52. Refer to the MySQL release notes for a full list     of changes:
    <A HREF=http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html>http://dev.mysql...

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was found that the MySQL PolyFromWKB() function did not sanity check Well-Known Binary (WKB) data. A remote, authenticated attacker could use specially crafted WKB data to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3840)

A flaw was found in the way MySQL processed certain JOIN queries. If a stored procedure contained JOIN queries, and that procedure was executed twice in sequence, it could cause an infinite loop, leading to excessive CPU use (up to 100%). A remote, authenticated attacker could use this flaw to cause a denial of service. (CVE-2010-3839)

A flaw was found in the way MySQL processed queries that provide a mixture of numeric and longblob data types to the LEAST or GREATEST function. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3838)

A flaw was found in the way MySQL processed PREPARE statements containing both GROUP_CONCAT and the WITH ROLLUP modifier. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3837)

It was found that MySQL did not properly pre-evaluate LIKE arguments in view prepare mode. A remote, authenticated attacker could possibly use this flaw to crash mysqld. (CVE-2010-3836)

A flaw was found in the way MySQL processed statements that assign a value to a user-defined variable and that also contain a logical value evaluation. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3835)

A flaw was found in the way MySQL evaluated the arguments of extreme-value functions, such as LEAST and GREATEST. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3833)

A flaw was found in the way MySQL processed EXPLAIN statements for some complex SELECT queries. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3682)

A flaw was found in the way MySQL processed certain alternating READ requests provided by HANDLER statements. A remote, authenticated attacker could use this flaw to provide such requests, causing mysqld to crash. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3681)

A flaw was found in the way MySQL processed CREATE TEMPORARY TABLE statements that define NULL columns when using the InnoDB storage engine. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3680)

A flaw was found in the way MySQL processed JOIN queries that attempt to retrieve data from a unique SET column. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3677)

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

This mysql update fixes the following security issues

  - CVE-2010-3833: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3834: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Insufficient Information     (CWE-noinfo)

  - CVE-2010-3835: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Numeric Errors (CWE-189)

  - CVE-2010-3836: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3837: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3838: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2010-3839: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2010-3840: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

ID	Name	Product	Family	Published	Updated	Severity
51530	Debian DSA-2143-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	1/17/2011	1/4/2021	medium
50806	CentOS 5 : mysql (CESA-2010:0825)	Nessus	CentOS Local Security Checks	11/24/2010	1/4/2021	medium
283959	MiracleLinux 3 : mysql-5.0.77-4.4.0.1.AXS3 (AXSA:2010-485:04)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	medium
17834	MySQL < 5.0.92 Multiple Denial of Service	Nessus	Databases	1/18/2012	11/15/2018	medium
284205	MiracleLinux 4 : mysql-5.1.52-1.AXS4.1 (AXSA:2011-32:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	medium
60884	Scientific Linux Security Update : mysql on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
75904	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2011:1250-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium
75589	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2011:1250-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium