CVE-2005-2572: MySQL User-Defined Functions Multiple Vulnerabilities

book

Article ID: 197371

calendar_today

Updated On:

Products

CA Spectrum

Issue/Introduction

We had a scan in our environment, and some vulnerabilities were found:

Security Vulnerabilities in the Spectrum environment

Vulnerability: High
Plugin: MySQL User-Defined Functions Multiple Vulnerabilities

https://cve.circl.lu/cve/CVE-2005-2572

Environment

Release : 10.x

Component : Spectrum Core / SpectroSERVER

Resolution

There is currently no known fix or patch to address these issues. Instead, make sure access to create user-defined functions is restricted.

The CVE Details refers to an older version of MySQL, 5.0.33.

The DX NetOps Spectrum 20.2.7/10.4.3 comes with MySQL 5.7.27 and Spectrum 21.2 will come with MySQL 5.7.33.

Additional Information

https://marc.info/?l=bugtraq&m=112360818900941&w=2

Multiple Issues with MySQL User Defined Functions

AppSecInc Team SHATTER Security Advisory MYSQL05-V0003
http://www.appsecinc.com/resources/alerts/mysql/2005-003.html
August 08, 2005

Risk level: LOW

Credits: This vulnerability was discovered and researched by Reid
Borsuk of Application Security Inc.

Affected Versions:
ALL

Background:
User-defined functions in MySQL allow a user in the database to call
binary libraries on the operating system. Creating a user-defined
function requires insert privileges on the mysql.func table.

Details:
By using specially crafted CREATE FUNCTION requests it may be possible
for attackers to halt the system or execute remote code on some
systems. Two specific issues are detailed below.

1) If an attacker asks a Windows based MySQL server to load an invalid
library file the application will hang until a dialog box is
acknowledged on the server. By requesting one of the many non-library
files included in the PATH by default on Windows installations a
server will be effectively halted. This is due to the fact that the
Windows function LoadLibraryEx() will block when loading an invalid
library file with the following message:

"The application or DLL XXXX is not a valid Windows image. Please
check this against your installation diskette."

It should be noted that this is a Windows specific issue; other
operating systems are not likely to be affected.

An attacker attempting to exploit this issue must have insert
privileges on the mysql.func table. This is a high level of privilege
that is not normally given to untrusted users.

2) MySQL attempts to filter execution of arbitrary libraries by
requiring any UDF libraries to have either XXX_deinit() or XXX_init()
functions defined. This is intended to prevent an attacker from
including any libraries that were not specifically programmed to work
with MySQL. Unfortunately this function naming convention is
relatively common and default libraries may have these functions defined.

For instance, the "jpeg1x32.dll" and "jpeg2x32.dll" libraries,
included by default with Windows 2000 have these functions defined.
This allows an attacker to load the jpeg_cmp() function from
"jpeg1x32.dll" and the jpeg_decmp() function from "jpeg2x32.dll". When
either of these functions is called, the MySQL daemon will crash due
to improper argument passing.

Both the jpeg_cmp_init() and jpeg_decmp_init() functions assumes there
are 6 arguments waiting for it on the stack. One of these, Arg 6
(EBP+0x1C) is assumed to be a pointer to a memory location. Areas of
the memory past this pointer are later overwritten by other arguments
passed to this function. Due to the fact that Arg 4 (EBP+0x14) through
Arg 6 (EBP+0x1C) are not used prior to this call, it may be possible
to pollute the stack and overwrite arbitrary memory locations with
attacker supplied values.

Although this is a Windows specific example, it is possible that other
operating systems are affected.

Exploiting this vulnerability would require the ability to create
user-defined functions. This is not typically granted to untrusted
users, however given this vulnerability you should understand the
ramifications of granting the ability to create user-defined functions.

Workaround:
Restrict access to create user-defined functions.

Vendor Status:
Vendor was contacted and declined to produce a patch.

Fix:
None is available.

 

https://www.cvedetails.com/cve/CVE-2005-2572/

Vulnerability Details : CVE-2005-2572

MySQL, when running on Windows, allows remote authenticated users with insert privileges on the mysql.func table to cause a denial of service (server hang) and possibly execute arbitrary code via (1) a request for a non-library file, which causes the Windows LoadLibraryEx function to block, or (2) a request for a function in a library that has the XXX_deinit or XXX_init functions defined but is not tailored for mySQL, such as jpeg1x32.dll and jpeg2x32.dll.
Publish Date : 2005-08-16 Last Update Date : 2017-07-10

- CVSS Scores & Vulnerability Types

CVSS Score
8.5
Confidentiality Impact Complete (There is total information disclosure, resulting in all system files being revealed.)
Integrity Impact Complete (There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised.)
Availability Impact Complete (There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.)
Access Complexity Medium (The access conditions are somewhat specialized. Some preconditions must be satistified to exploit)
Authentication Single system (The vulnerability requires an attacker to be logged into the system (such as at a command line or via a desktop session or web interface).)
Gained Access Admin
Vulnerability Type(s) Denial Of ServiceExecute Code
CWE ID CWE id is not defined for this vulnerability
 

- Products Affected By CVE-2005-2572

# Product Type Vendor Product Version Update Edition Language  
1 Application Mysql Mysql 5.0.33       Version Details Vulnerabilities