CVE-2012-4414

Published: 22 January 2013

Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.

Priority

Medium

Status

Package Release Status
mysql-5.1
Launchpad, Ubuntu, Debian
Upstream Needs triage

mysql-5.5
Launchpad, Ubuntu, Debian
Upstream
Released (5.5.30+dfsg-1)
mysql-cluster-7.0
Launchpad, Ubuntu, Debian
Upstream Needs triage

mysql-dfsg-5.0
Launchpad, Ubuntu, Debian
Upstream Needs triage

mysql-dfsg-5.1
Launchpad, Ubuntu, Debian
Upstream Needs triage

Notes

AuthorNote
jdstrand
mysql-cluster-7.0 not supported per Ubuntu Server team
As of 2012/01/09, Oracle no longer supports MySQL 5.0.
Unfortunately, because of upstream update and commit policies it is not
possible to backport patches from later releases. Ubuntu is regrettably
unable to support MySQL 5.0 and users are encouraged to upgrade to Ubuntu
10.04 LTS or later.
mdeslaur
incomplete fix in 5.5.29, see:
http://www.mysqlperformanceblog.com/2013/01/13/cve-2012-4414-in-mysql-5-5-29-and-percona-server-5-5-29/
jdstrand
watch for fix in 5.5.31
Debian released 5.5.30+dfsg-1 claiming to have fixed this issue
as of 2013-03-25, no complete fix from upstream
seth-arnold
Not actually fixed in 1807-1 -- my mistake

References

Bugs