Vulnerability Name:

CVE-2012-5614 (CCN-80434)

Assigned:2012-12-01
Published:2012-12-01
Updated:2022-08-29
Summary:Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.
CVSS v3 Severity:3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.6 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:F/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.6 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:F/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.0 Medium (REDHAT CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.6 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:F/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2012-5614

Source: CCN
Type: MySQL Web site
MySQL

Source: CCN
Type: Packetstorm Security Website
Oracle MySQL 5.5.19-log Denial Of Service

Source: CCN
Type: RHSA-2013-0772
Important: mysql security update

Source: REDHAT
Type: Third Party Advisory
RHSA-2013:0772

Source: FULLDISC
Type: Exploit, Mailing List, Third Party Advisory
20121201 MySQL Denial of Service Zeroday PoC

Source: CCN
Type: SA51427
Oracle MySQL Server Multiple Vulnerabilities

Source: SECUNIA
Type: Not Applicable
53372

Source: GENTOO
Type: Third Party Advisory
GLSA-201308-06

Source: MANDRIVA
Type: Broken Link
MDVSA-2013:150

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday

Source: CCN
Type: Oracle Web site
Oracle Critical Patch Update Advisory - April 2013

Source: CONFIRM
Type: Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html

Source: CCN
Type: OSVDB ID: 88065
Oracle MySQL Server COM_BINLOG_DUMP Invalid Data Handling DoS

Source: CCN
Type: BID-56776
Oracle MySQL CVE-2012-5614 Denial of Service Vulnerability

Source: SECTRACK
Type: Broken Link, Third Party Advisory, VDB Entry
1027829

Source: MISC
Type: Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=882607

Source: XF
Type: UNKNOWN
mysql-combinlogdump-dos(80434)

Source: MISC
Type: Broken Link, Patch
https://mariadb.atlassian.net/browse/MDEV-3910

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [12-02-2012]

Vulnerable Configuration:Configuration 1:
  • cpe:/a:oracle:mysql:*:*:*:*:*:*:*:* (Version >= 5.1.0 and <= 5.1.67)
  • OR cpe:/a:oracle:mysql:*:*:*:*:*:*:*:* (Version >= 5.5.0 and <= 5.5.29)

    • Configuration 2:
  • cpe:/a:mariadb:mariadb:*:*:*:*:*:*:*:* (Version >= 5.5.0 and < 5.5.30)
  • OR cpe:/a:mariadb:mariadb:*:*:*:*:*:*:*:* (Version >= 10.0.0 and < 10.0.2)

    • Configuration 3:
  • cpe:/o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:oracle:mysql:5.1.53:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:mysql:5.5.19:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:6:*:server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:mysql:5.6.10:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:23852
    P
    		ELSA-2013:0772: mysql security update (Important)
    2014-05-26
    oval:org.mitre.oval:def:20971
    P
    		RHSA-2013:0772: mysql security update (Important)
    2014-02-17
    oval:com.redhat.rhsa:def:20130772
    P
    		RHSA-2013:0772: mysql security update (Important)
    2013-04-25
    oval:com.ubuntu.precise:def:20125614000
    V
    		CVE-2012-5614 on Ubuntu 12.04 LTS (precise) - medium.
    2012-12-03
    BACK
    oracle mysql *
    oracle mysql *
    mariadb mariadb *
    mariadb mariadb *
    redhat enterprise linux server aus 6.4
    redhat enterprise linux desktop 6.0
    redhat enterprise linux server 6.0
    redhat enterprise linux workstation 6.0
    redhat enterprise linux eus 6.4
    oracle mysql 5.1.53
    oracle mysql 5.5.19
    redhat enterprise linux 6
    redhat enterprise linux 6
    redhat enterprise linux desktop 6
    redhat enterprise linux hpc node 6
    oracle mysql 5.6.10