CVE-2016-1249 - Vulnerability Details - OpenCVE

The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dbd-mysql Project	Dbd-mysql

Configuration 1 [-]

cpe:2.3:a:dbd-mysql_project:dbd-mysql:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes
http://www.openwall.com/lists/oss-security/2016/11/16/1
http://www.securityfocus.com/bid/94350
https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe
https://nvd.nist.gov/vuln/detail/CVE-2016-1249
https://security.gentoo.org/glsa/201701-51
https://www.cve.org/CVERecord?id=CVE-2016-1249

History

No history.

MITRE

Status: PUBLISHED

Assigner: debian

Published: 2017-02-16T18:00:00

Updated: 2024-08-05T22:48:13.661Z

Reserved: 2015-12-27T00:00:00

Link: CVE-2016-1249

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-02-17T02:59:10.780

Modified: 2024-11-21T02:46:02.163

Link: CVE-2016-1249

Redhat

Severity : Moderate

Publid Date: 2016-11-15T00:00:00Z

Links: CVE-2016-1249 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-11-15T00:00:00", "descriptions": [{"lang": "en", "value": "The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-30T16:57:01", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"name": "[oss-security] 20161115 CVE-2016-1249: Out-of-bounds read by DBD::mysql >= version 2.9003", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/11/16/1"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe"}, {"name": "94350", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/94350"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes"}, {"name": "GLSA-201701-51", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201701-51"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@debian.org", "ID": "CVE-2016-1249", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20161115 CVE-2016-1249: Out-of-bounds read by DBD::mysql >= version 2.9003", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/11/16/1"}, {"name": "https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe", "refsource": "CONFIRM", "url": "https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe"}, {"name": "94350", "refsource": "BID", "url": "http://www.securityfocus.com/bid/94350"}, {"name": "http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes", "refsource": "CONFIRM", "url": "http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes"}, {"name": "GLSA-201701-51", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201701-51"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T22:48:13.661Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20161115 CVE-2016-1249: Out-of-bounds read by DBD::mysql >= version 2.9003", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/11/16/1"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe"}, {"name": "94350", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/94350"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes"}, {"name": "GLSA-201701-51", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201701-51"}]}]}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2016-1249", "datePublished": "2017-02-16T18:00:00", "dateReserved": "2015-12-27T00:00:00", "dateUpdated": "2024-08-05T22:48:13.661Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dbd-mysql_project:dbd-mysql:*:*:*:*:*:*:*:*", "matchCriteriaId": "C776DED8-B178-4AAA-9A14-23FBA456A3BB", "versionEndIncluding": "4.038_01", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression."}, {"lang": "es", "value": "El m\u00f3dulo DBD::mysql en versiones anteriores a 4.039 para Perl, cuando se utiliza el soporte de sentencia preparada en el servidor, permite a atacantes provocar una denegaci\u00f3n de servicio (lectura fuera de l\u00edmites) a trav\u00e9s de vectores que implican un n\u00famero no alineado de marcadores de posici\u00f3n en la condici\u00f3n WHERE y campos de salida en expresi\u00f3n SELECT."}], "id": "CVE-2016-1249", "lastModified": "2024-11-21T02:46:02.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-02-17T02:59:10.780", "references": [{"source": "security@debian.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes"}, {"source": "security@debian.org", "tags": ["Mailing List", "Mitigation", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/11/16/1"}, {"source": "security@debian.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/94350"}, {"source": "security@debian.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe"}, {"source": "security@debian.org", "url": "https://security.gentoo.org/glsa/201701-51"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Mitigation", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/11/16/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/94350"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201701-51"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}