[Fwd: [Full-Disclosure] [[email protected]: Re: MySQL 3.23.54a can be crased with a exploit for 3.23.53]]

-----Forwarded Message-----

From: Len Rose <[email protected]>
To: [email protected]
Subject: [Full-Disclosure] [[email protected]: Re: MySQL 3.23.54a can be crased with a exploit for 3.23.53]
Date: 21 Jan 2003 10:39:22 -0500

----- Forwarded message from Sergei Golubchik <[email protected]> -----

Mailing-List: contact [email protected]; run by ezmlm (http://www.ezmlm.org)
List-ID: <mysql.mysql.com>
Precedence: bulk
List-Help: <mailto:[email protected]>
List-Unsubscribe: <mailto:[email protected]>
List-Post: <mailto:[email protected]>
List-Subscribe: <mailto:[email protected]>
Delivered-To: mailing list [email protected]
Date: Tue, 21 Jan 2003 16:19:42 +0100
From: Sergei Golubchik <[email protected]>
To: Dennis Kruyt <[email protected]>
Cc: [email protected], [email protected], [email protected]
Subject: Re: MySQL 3.23.54a can be crased with a exploit for 3.23.53
Mail-Followup-To: Dennis Kruyt <[email protected]>, [email protected],
	[email protected], [email protected]
In-Reply-To: <1A231876B7149843A53D220337C84A0009DA85@exchange-test.office.zx.nl>
User-Agent: Mutt/1.5.1i

Hi!

On Jan 21, Dennis Kruyt wrote:
> Hi,
> 
> When I try the hoagie_mysql exploit from http://void.at/releases.html
> on a 3.23.54a MySQL server (witch sould be safe) then i can crash the
> database with this.
> 
> How did I do it?
> 
> I start hoagie_mysql with a valid db user (not root). Then press ctrl-c
> (abort) and start the tool again. Now the tool has reported that the
> attack has failed. But the MySQL db is restarted if i look in the error
> log and some normal connectie to the database then will fail. I have
> tried it on several server with success.

You should've contacted us (using [email protected]) first
so we'd be able to release fixed version :(

Anyway, this is fixed. 3.23.55 will be released soon.
For impatients, there's our bk tree, available publicaly

Thanks for bugreport.

Regards,
Sergei

-- 
MySQL Development Team
   __  ___     ___ ____  __
  /  |/  /_ __/ __/ __ \/ /   Sergei Golubchik <[email protected]>
 / /|_/ / // /\ \/ /_/ / /__  MySQL AB, http://www.mysql.com/
/_/  /_/\_, /___/\___\_\___/  Osnabrueck, Germany
       <___/

---------------------------------------------------------------------
Before posting, please check:
   http://www.mysql.com/manual.php   (the manual)
   http://lists.mysql.com/           (the list archive)

To request this thread, e-mail <[email protected]>
To unsubscribe, e-mail <[email protected]>
Trouble unsubscribing? Try: http://lists.mysql.com/php/unsubscribe.php

----- End forwarded message -----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

-- 
I think, therefore, ken_i_m
Chief Gadgeteer,
Elegant Innovations

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQA+LfJf8MCUo3oeQ4kRAiX7AKDDno6hHTA8raL+bUYTYtWTeH4zqQCfah78
j6Ode7KRn+KE5hghtzt1OmQ=
=wNim
-----END PGP SIGNATURE-----