CVE-2016-1249

The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.

Pali Rohar discovered that DBD::mysql constructed an error message in a fixed-length buffer, leading to a crash (_FORTIFY_SOURCE failure) and, potentially, to denial of service (CVE-2016-1246).

A vulnerability was discovered in perl-DBD-MySQL that can lead to an out-of-bounds read when using server side prepared statements with an unaligned number of placeholders in WHERE condition and output fields in SELECT expression (CVE-2016-1249).

There is a vulnerability of type use-after-free affecting DBD::mysql before 4.041 when used with mysql_server_prepare=1 (CVE-2016-1251).

The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples (CVE-2017-10788).

The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack (CVE-2017-10789).

Note that the CVE-2016-1246, CVE-2017-1249, and CVE-2016-1251 issues only affected Mageia 5.

Also note that server-side prepared statements are disabled by default.

These are all security issues fixed in the perl-DBD-mysql-4.041-2.1 package on the GA media of openSUSE Tumbleweed.

This update for perl-DBD-mysql fixes the following issues:

• CVE-2016-1246: Buffer overflow allowed context-dependent attackers to cause a denial of service (crash) via vectors related to an error message (bsc#1002626).
• CVE-2016-1249: Out-of-bounds read when using server-side prepared statement support (bsc#1010457).

This update for perl-DBD-mysql fixes the following issues:

• CVE-2016-1251: A use-after-free when used with mysql_server_prepare=1 (bsc#1012546).
• CVE-2016-1246: Buffer overflow allowed context-dependent attackers to cause a denial of service (crash) via vectors related to an error message (bsc#1002626).
• CVE-2016-1249: Out-of-bounds read when using server-side prepared statement support (bsc#1010457).

It was discovered that the DBD::mysql module, when configured with server-side prepared statement support, was susceptible to operations that would result in improper memory access. An attacker could possibly use this issue to cause DBD::mysql to crash, resulting in a denial of service. (CVE-2016-1249, CVE-2016-1251)

It was discovered that the DBD::mysql module was susceptible to an operation that would result in improper memory access, introduced through incorrect documentation and code examples. An attacker could possibly use this issue to cause DBD::mysql to crash or potentially cause other, unspecified, impact. (CVE-2017-10788)

It was discovered that the DBD::mysql module processed SSL/TLS settings in a way that did not fully correlate with the respective documentation for each setting. An attacker could possibly use this to perform a cleartext-downgrade attack. (CVE-2017-10789)

It was discovered that libdbd-mysql-perl did not correctly handle certain SQL queries. An attacker could possibly use this issue to cause a denial of service. (CVE-2016-1249)

It was discovered that libdbd-mysql-perl did not correctly handle certain memory operations, which could lead to a use-after-free vulnerability. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2016-1251, CVE-2017-10788)

It was discovered that libdbd-mysql-perl did not properly enforce SSL connections depending on the mysql_ssl setting. A machine-in-the-middle attacker could possibly use this issue to spoof servers. (CVE-2017-10789)