full-disclosure - RE: MySQL DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060615181711.5C87.CARDOSOLISTAS@contraditorium.com>
Date: Thu Jun 15 22:17:58 2006
From: cardosolistas at contraditorium.com (Cardoso)
Subject: RE: MySQL DoS

mysql 5.0.20 Community version under Windows XP Professional

Query works fine, no crash at all.

On Thu, 15 Jun 2006 15:50:21 -0400
"Brent Meshier" <brent@...cia-co.com> wrote:

BM> I am not able to reproduce this bug.
BM> 
BM>  mysql> select str_to_date( 1, NULL );
BM> +------------------------+
BM> | str_to_date( 1, NULL ) |
BM> +------------------------+
BM> | NULL                   |
BM> +------------------------+
BM> 1 row in set (0.00 sec)
BM> 
BM> 
BM> Brent Meshier
BM> Director IT Operations
BM> Global Transport Logistics
BM> Garcia & Co Fulfillment
BM> http://www.garcia-co.com/
BM> (877) 257-SHIP ext 23
BM>  
BM> 
BM> -----Original Message-----
BM> From: Tonnerre Lombard [mailto:tonnerre.lombard@...roup.ch] 
BM> Sent: Thursday, June 15, 2006 1:42 AM
BM> To: Kanatoko
BM> Cc: bugtraq@...urityfocus.com; full-disclosure@...ts.grok.org.uk
BM> Subject: Re: MySQL DoS
BM> 
BM> Salut,
BM> 
BM> On Thu, 2006-06-15 at 02:24 +0900, Kanatoko wrote:
BM> > A query like "select str_to_date( 1, NULL );" crashes mysqld.
BM> 
BM> mysql  Ver 14.12 Distrib 5.0.18, for -netbsd (alpha) using  EditLine
BM> wrapper
BM> -> not affected
BM> 
BM> mysql  Ver 14.7 Distrib 4.1.15, for pc-linux-gnu (i486) using readline
BM> 5.1
BM> -> affected
BM> 
BM> mysql  Ver 12.22 Distrib 4.0.18, for mandrake-linux-gnu (i586)
BM> -> affected
BM> 
BM> 				Tonnerre
BM> --
BM> SyGroup GmbH
BM> Tonnerre Lombard
BM> 
BM> Loesungen mit System
BM> Tel:+41 61 333 80 33    Roeschenzerstrasse 9
BM> Fax:+41 61 383 14 67    4153 Reinach
BM> Web:www.sygroup.ch      tonnerre.lombard@...roup.ch
BM> 
BM> _______________________________________________
BM> Full-Disclosure - We believe in it.
BM> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
BM> Hosted and sponsored by Secunia - http://secunia.com/
BM> 

Allgemeinen Anschulterlaubnis
Cardoso <cardoso@...ox.com> - SkypeIn: (11) 3711-2466 / (41) 3941-5299
vida digital: http://www.contraditorium.com site pessoal e blog: http://www.carloscardoso.com