Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40426

CONNECT writes unvalidated data from remote server into fixed-len buffer

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      CONNECT's MyColumns() parses the field-type string returned by a remote MySQL/MariaDB server using sscanf with no width limits on %s and %[^(] conversions.

      malicious remote server can cause it to overflow local on-stack buffers.

      Reported by TrendAI Zero Day Initiative

      Attachments

        Activity

          People

            danblack Daniel Black
            serg Sergei Golubchik
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 1h
                1h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.