mailing list archives
Re: MySQL 0-day - does it need a CVE?
From: Kurt Seifried <kseifried () redhat com>
Date: Fri, 24 Feb 2012 13:28:05 -0700
On 02/24/2012 03:11 AM, Tomas Hoger wrote:
On Thu, 09 Feb 2012 10:20:14 -0700 Kurt Seifried wrote:
We are releasing a working MySQL 5.5.20 remote 0day exploit with this
update.The exploit has been tested with
mysql-5.5.20-debian6.0-i686.deb on Debian 6.0.
According to the video, it should be "yassl buffer overflow".
Ok according to the video:
This vulnerability affects the yaSSL authentication portion (so SSL
certificate based authentication of clients).
This attack is "reliable", usually works on the first try, but if it
fails it will DoS MySQL and MySQL will require a restart.
So it sounds like this might actually be a yaSSL vulnerability and not
specific to MySQL. CC'ing support () yassl com so they are aware of this
Please use CVE-2012-0882 for this issue.
Kurt Seifried Red Hat Security Response Team (SRT)
Re: MySQL 0-day - does it need a CVE? Tomas Hoger (Feb 24)
- Re: MySQL 0-day - does it need a CVE? Kurt Seifried (Feb 24)