Re: RE: MySQL DoS

[Cardoso <cardosolistas () contraditorium com>]

mysql 5.0.20 Community version under Windows XP Professional

Query works fine, no crash at all.



On Thu, 15 Jun 2006 15:50:21 -0400
"Brent Meshier" <brent () garcia-co com> wrote:

BM> I am not able to reproduce this bug.
BM> 
BM>  mysql> select str_to_date( 1, NULL );
BM> +------------------------+
BM> | str_to_date( 1, NULL ) |
BM> +------------------------+
BM> | NULL                   |
BM> +------------------------+
BM> 1 row in set (0.00 sec)
BM> 
BM> 
BM> Brent Meshier
BM> Director IT Operations
BM> Global Transport Logistics
BM> Garcia & Co Fulfillment
BM> http://www.garcia-co.com/
BM> (877) 257-SHIP ext 23
BM>  
BM> 
BM> -----Original Message-----
BM> From: Tonnerre Lombard [mailto:tonnerre.lombard () sygroup ch] 
BM> Sent: Thursday, June 15, 2006 1:42 AM
BM> To: Kanatoko
BM> Cc: bugtraq () securityfocus com; full-disclosure () lists grok org uk
BM> Subject: Re: MySQL DoS
BM> 
BM> Salut,
BM> 
BM> On Thu, 2006-06-15 at 02:24 +0900, Kanatoko wrote:
BM> > A query like "select str_to_date( 1, NULL );" crashes mysqld.
BM> 
BM> mysql  Ver 14.12 Distrib 5.0.18, for -netbsd (alpha) using  EditLine
BM> wrapper
BM> -> not affected
BM> 
BM> mysql  Ver 14.7 Distrib 4.1.15, for pc-linux-gnu (i486) using readline
BM> 5.1
BM> -> affected
BM> 
BM> mysql  Ver 12.22 Distrib 4.0.18, for mandrake-linux-gnu (i586)
BM> -> affected
BM> 
BM>                             Tonnerre
BM> --
BM> SyGroup GmbH
BM> Tonnerre Lombard
BM> 
BM> Loesungen mit System
BM> Tel:+41 61 333 80 33    Roeschenzerstrasse 9
BM> Fax:+41 61 383 14 67    4153 Reinach
BM> Web:www.sygroup.ch      tonnerre.lombard () sygroup ch
BM> 
BM> _______________________________________________
BM> Full-Disclosure - We believe in it.
BM> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
BM> Hosted and sponsored by Secunia - http://secunia.com/
BM> 

Allgemeinen Anschulterlaubnis
Cardoso <cardoso () pobox com> - SkypeIn: (11) 3711-2466 / (41) 3941-5299
vida digital: http://www.contraditorium.com site pessoal e blog: http://www.carloscardoso.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/