Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Sun MySQL mysql_log Format String Vulnerability

Subscribe

Check Point Reference: CPAI-2009-205
Date Published:
Severity:
Source: Secunia: SA35767
Industry Reference(s): N/A
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Sun Microsystems MySQL 4.x
Sun Microsystems MySQL 5.0.83 and prior
Vulnerability Description
A format string vulnerability exists in Sun Microsystems MySQL database server, a popular open-source implementation of a relational database. The flaw is due to insufficient input validation when processing database commands. Remote authenticated attackers could exploit this vulnerability by sending malformed data to the MySQL process. Successful exploitation could result in a denial of service condition.
Update/Patch Available
The vendor, Sun Microsystems, has released an advisory addressing this vulnerability:
http://lists.mysql.com/commits/77637
Vulnerability Details
The vulnerability is caused due to a format string error within the "dispatch_command()" function in sql_parse.cc. This can be exploited to crash an affected service via specially crafted "COM_CREATE_DB" or "COM_DROP_DB" requests.

Protection Overview
By enabling this protection, IPS-1 will detect and block SQL Drop table statements that contain format string specifiers.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Network Intelligence > MySQL Parser, and select the MySQL Vulnerabilities protection group.
3. Click MySQL mysql_log Format String Vulnerability (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name: MySQL Backend
Description: MySQL mysql_log Format String Vulnerability