Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against MySQL XML Functions Scalar XPath Denial of Service

Subscribe

Check Point Reference: CPAI-2009-383
Date Published:
Severity:
Last Updated:
Source: Secunia Advisory: SA34115
Industry Reference(s): CVE-2009-0819
Protection Provided by: Security Gateway
  • R75
Who is Vulnerable?
Sun Microsystems MySQL 5.1.15
Sun Microsystems MySQL 5.1.30
Sun Microsystems MySQL 5.1.32-bzr
Sun Microsystems MySQL 6.0.9
Vulnerability Description
MySQL is an open-source implementation of a relational database management system. MySQL supports the SQL (Structured Query Language) database query language. The database product allows remote network connections from client applications over the proprietary MySQL network protocol. MySQL Server listens on TCP port 3306 by default.
Vulnerability Details
A vulnerability exists in MySQL database engine. The vulnerability is due to insufficient input validation of XML functions used in SQL statements. A remote authenticated attacker can exploit this vulnerability by sending crafted requests to the target host. Successful exploitation would be a denial of service (DoS) condition of MySQL database services on the target host.
In a successful attack case, the affected server will terminate and all established connections will also be terminated.

Protection Overview
This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R75

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > IPS Software Blade > Application Intelligence > Database Protections > MySQL.
2. In the right pane, double-click the MySQL XML Functions Scalar XPath Denial of Service protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: MySQL Protection Violation
Attack Information: MySQL XML functions scalar XPath denial of service