CVE-2010-3682

Executive Summary

Informations
Name	CVE-2010-3682	First vendor Publication	2011-01-11
Vendor	Cve	Last vendor Modification	2013-01-21

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Cvss Base Score	4	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	8	Authentification	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using EXPLAIN with crafted "SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)" statements, which triggers a NULL pointer dereference in the Item_singlerow_subselect::store function.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3682

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mysql Mysql cpe:/a:mysql:mysql:5.1.48 cpe:/a:mysql:mysql:5.1.47 cpe:/a:mysql:mysql:5.1.46:sp1 cpe:/a:mysql:mysql:5.1.46 cpe:/a:mysql:mysql:5.1.45 cpe:/a:mysql:mysql:5.1.44 cpe:/a:mysql:mysql:5.1.43:sp1 cpe:/a:mysql:mysql:5.1.43 cpe:/a:mysql:mysql:5.1.42 cpe:/a:mysql:mysql:5.1.41 cpe:/a:mysql:mysql:5.1.40:sp1 cpe:/a:mysql:mysql:5.1.40 cpe:/a:mysql:mysql:5.1.4 cpe:/a:mysql:mysql:5.1.39 cpe:/a:mysql:mysql:5.1.38 cpe:/a:mysql:mysql:5.1.37:sp1 cpe:/a:mysql:mysql:5.1.37 cpe:/a:mysql:mysql:5.1.36 cpe:/a:mysql:mysql:5.1.35 cpe:/a:mysql:mysql:5.1.34:sp1 cpe:/a:mysql:mysql:5.1.34 cpe:/a:mysql:mysql:5.1.33 cpe:/a:mysql:mysql:5.1.32-bzr cpe:/a:mysql:mysql:5.1.32 cpe:/a:mysql:mysql:5.1.31:sp1 cpe:/a:mysql:mysql:5.1.31 cpe:/a:mysql:mysql:5.1.30 cpe:/a:mysql:mysql:5.1.3 cpe:/a:mysql:mysql:5.1.29 cpe:/a:mysql:mysql:5.1.28 cpe:/a:mysql:mysql:5.1.27 cpe:/a:mysql:mysql:5.1.26 cpe:/a:mysql:mysql:5.1.25 cpe:/a:mysql:mysql:5.1.24 cpe:/a:mysql:mysql:5.1.23a cpe:/a:mysql:mysql:5.1.23_bk cpe:/a:mysql:mysql:5.1.23 cpe:/a:mysql:mysql:5.1.23:a cpe:/a:mysql:mysql:5.1.22 cpe:/a:mysql:mysql:5.1.21 cpe:/a:mysql:mysql:5.1.20 cpe:/a:mysql:mysql:5.1.2 cpe:/a:mysql:mysql:5.1.19 cpe:/a:mysql:mysql:5.1.18 cpe:/a:mysql:mysql:5.1.17 cpe:/a:mysql:mysql:5.1.16 cpe:/a:mysql:mysql:5.1.15 cpe:/a:mysql:mysql:5.1.14 cpe:/a:mysql:mysql:5.1.13 cpe:/a:mysql:mysql:5.1.12 cpe:/a:mysql:mysql:5.1.11 cpe:/a:mysql:mysql:5.1.10 cpe:/a:mysql:mysql:5.1.1 cpe:/a:mysql:mysql:5.0.91 cpe:/a:mysql:mysql:5.0.90 cpe:/a:mysql:mysql:5.0.89 cpe:/a:mysql:mysql:5.0.88 cpe:/a:mysql:mysql:5.0.87:sp1 cpe:/a:mysql:mysql:5.0.87 cpe:/a:mysql:mysql:5.0.86 cpe:/a:mysql:mysql:5.0.85 cpe:/a:mysql:mysql:5.0.84:sp1 cpe:/a:mysql:mysql:5.0.84 cpe:/a:mysql:mysql:5.0.83 cpe:/a:mysql:mysql:5.0.82:sp1 cpe:/a:mysql:mysql:5.0.82 cpe:/a:mysql:mysql:5.0.81 cpe:/a:mysql:mysql:5.0.80 cpe:/a:mysql:mysql:5.0.79 cpe:/a:mysql:mysql:5.0.78 cpe:/a:mysql:mysql:5.0.77 cpe:/a:mysql:mysql:5.0.76 cpe:/a:mysql:mysql:5.0.75 cpe:/a:mysql:mysql:5.0.74 cpe:/a:mysql:mysql:5.0.74:sp1 cpe:/a:mysql:mysql:5.0.72:sp1 cpe:/a:mysql:mysql:5.0.72 cpe:/a:mysql:mysql:5.0.70 cpe:/a:mysql:mysql:5.0.68 cpe:/a:mysql:mysql:5.0.67 cpe:/a:mysql:mysql:5.0.66:sp1 cpe:/a:mysql:mysql:5.0.66 cpe:/a:mysql:mysql:5.0.66:a cpe:/a:mysql:mysql:5.0.64 cpe:/a:mysql:mysql:5.0.62 cpe:/a:mysql:mysql:5.0.60 cpe:/a:mysql:mysql:5.0.58 cpe:/a:mysql:mysql:5.0.56 cpe:/a:mysql:mysql:5.0.56:sp1 cpe:/a:mysql:mysql:5.0.54 cpe:/a:mysql:mysql:5.0.52 cpe:/a:mysql:mysql:5.0.51:a cpe:/a:mysql:mysql:5.0.51:b cpe:/a:mysql:mysql:5.0.50 cpe:/a:mysql:mysql:5.0.48 cpe:/a:mysql:mysql:5.0.46 cpe:/a:mysql:mysql:5.0.45 cpe:/a:mysql:mysql:5.0.44 cpe:/a:mysql:mysql:5.0.44:sp1 cpe:/a:mysql:mysql:5.0.42 cpe:/a:mysql:mysql:5.0.41 cpe:/a:mysql:mysql:5.0.40 cpe:/a:mysql:mysql:5.0.38 cpe:/a:mysql:mysql:5.0.37 cpe:/a:mysql:mysql:5.0.36:sp1 cpe:/a:mysql:mysql:5.0.36 cpe:/a:mysql:mysql:5.0.34 cpe:/a:mysql:mysql:5.0.33 cpe:/a:mysql:mysql:5.0.32 cpe:/a:mysql:mysql:5.0.30:sp1 cpe:/a:mysql:mysql:5.0.30 cpe:/a:mysql:mysql:5.0.28 cpe:/a:mysql:mysql:5.0.27 cpe:/a:mysql:mysql:5.0.24 cpe:/a:mysql:mysql:5.0.22 cpe:/a:mysql:mysql:5.0.21 cpe:/a:mysql:mysql:5.0.20a cpe:/a:mysql:mysql:5.0.20 cpe:/a:mysql:mysql:5.0.2 cpe:/a:mysql:mysql:5.0.1a cpe:/a:mysql:mysql:5.0.19 cpe:/a:mysql:mysql:5.0.18 cpe:/a:mysql:mysql:5.0.17a cpe:/a:mysql:mysql:5.0.17 cpe:/a:mysql:mysql:5.0.16a cpe:/a:mysql:mysql:5.0.16 cpe:/a:mysql:mysql:5.0.15a cpe:/a:mysql:mysql:5.0.15 cpe:/a:mysql:mysql:5.0.14 cpe:/a:mysql:mysql:5.0.13 cpe:/a:mysql:mysql:5.0.12 cpe:/a:mysql:mysql:5.0.11 cpe:/a:mysql:mysql:5.0.10a cpe:/a:mysql:mysql:5.0.10 cpe:/a:mysql:mysql:5.0.1 cpe:/a:mysql:mysql:5.0.0:alpha cpe:/a:mysql:mysql:5.0.0	137

Open Source Vulnerability Database (OSVDB)

id	Description
67383	MySQL EXPLAIN Statement Item_singlerow_subselect::store Function NULL Derefer...

Internal Sources (Detail)

Source	Url
APPLE	http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
BID	http://www.securityfocus.com/bid/42599
CONFIRM	http://bugs.mysql.com/bug.php?id=52711 http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html http://support.apple.com/kb/HT4723 https://bugzilla.redhat.com/show_bug.cgi?id=628328
DEBIAN	http://www.debian.org/security/2011/dsa-2143
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2010:155 http://www.mandriva.com/security/advisories?name=MDVSA-2010:222 http://www.mandriva.com/security/advisories?name=MDVSA-2011:012
MLIST	http://www.openwall.com/lists/oss-security/2010/09/28/10
REDHAT	http://www.redhat.com/support/errata/RHSA-2010-0825.html http://www.redhat.com/support/errata/RHSA-2011-0164.html
SECUNIA	http://secunia.com/advisories/42875 http://secunia.com/advisories/42936
SUSE	http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
TURBO	http://www.turbolinux.co.jp/security/2011/TLSA-2011-3j.txt
UBUNTU	http://www.ubuntu.com/usn/USN-1017-1
VUPEN	http://www.vupen.com/english/advisories/2011/0105 http://www.vupen.com/english/advisories/2011/0133 http://www.vupen.com/english/advisories/2011/0170 http://www.vupen.com/english/advisories/2011/0345
XF	http://xforce.iss.net/xforce/xfdb/64684

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-10 23:33:56	Multiple Updates
2013-01-22 00:21:38	Multiple Updates
2013-01-21 21:22:32	Multiple Updates

Type	Count
CPE ID(s)	137
osvdb(s)	1

Related	Severity
USN-1397-1	(High)
GLSA-201201-02	(High)
USN-1017-1	(Medium)
RHSA-2011:0164	(Medium)
RHSA-2010:0825	(Medium)
MDVSA-2010:222	(Medium)
DSA-2143	(Medium)
MDVSA-2011:012	(Medium)
MDVSA-2010:155-1	(Medium)
MDVSA-2010:155	(Medium)