{"id":1650,"date":"2010-01-19T09:00:46","date_gmt":"2010-01-19T14:00:46","guid":{"rendered":"http:\/\/www.bytebot.net\/blog\/?p=1650"},"modified":"2010-01-19T09:00:46","modified_gmt":"2010-01-19T14:00:46","slug":"mysql-with-yassl-vulnerability","status":"publish","type":"post","link":"https:\/\/www.bytebot.net\/blog\/archives\/2010\/01\/19\/mysql-with-yassl-vulnerability","title":{"rendered":"MySQL with yaSSL vulnerability"},"content":{"rendered":"<p>It&#8217;s worth noting that if you&#8217;re using MySQL 5.0\/5.1, with SSL enabled, and you&#8217;re using <a href=\"http:\/\/www.yassl.com\/\">yaSSL<\/a> as opposed to OpenSSL, you&#8217;re vulnerable to <a href=\"http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2009-4484\">CVE-2009-4484<\/a>. Its a buffer overflow, that works over TCP, via the MySQL port, 3306. <a href=\"http:\/\/www.lenzg.net\/\">Lenz<\/a> furnished us with some <a href=\"http:\/\/lists.mysql.com\/packagers\/444\">information<\/a>, and the <a href=\"http:\/\/lists.mysql.com\/commits\/96697\">patch<\/a> is available. You&#8217;ll see this rocking when MySQL 5.1.43 gets released. <\/p>\n<p>It affects Debian (presumably, it will also affect Ubuntu). Red Hat\/CentOS is <a href=\"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=555313\">spared<\/a>, because instead of using yaSSL, OpenSSL is used. <\/p>\n<p>MariaDB <a href=\"http:\/\/askmonty.org\/wiki\/index.php\/MariaDB:Download\">5.1.41-rc<\/a> (based on MySQL 5.1.41) which was just released a few days ago, naturally is also affected. The next release candidate might potentially be rebased against 5.1.42 (the builds are already ready, from what I understand), and will include this patch.<\/p>\n<p><b>Some yaSSL trivia:<\/b> did you know that one of the two co-founders of the project, is actually Larry Stefonic? Larry was an early MySQL Ab employee, holding quite a few positions at MySQL Ab; he was the President of MySQL KK (the Japanese branch), and was also SVP for worldwide OEM sales!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It&#8217;s worth noting that if you&#8217;re using MySQL 5.0\/5.1, with SSL enabled, and you&#8217;re using yaSSL as opposed to OpenSSL, you&#8217;re vulnerable to CVE-2009-4484. Its a buffer overflow, that works over TCP, via the MySQL port, 3306. Lenz furnished us with some information, and the patch is available. You&#8217;ll see this rocking when MySQL 5.1.43 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[23],"tags":[1052,1775,68,1053],"class_list":["post-1650","post","type-post","status-publish","format-standard","hentry","category-mysql","tag-mariadb","tag-mysql","tag-security","tag-yassl"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/p4vJD-qC","jetpack_sharing_enabled":true,"jetpack-related-posts":[],"amp_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/posts\/1650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/comments?post=1650"}],"version-history":[{"count":1,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/posts\/1650\/revisions"}],"predecessor-version":[{"id":1651,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/posts\/1650\/revisions\/1651"}],"wp:attachment":[{"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/media?parent=1650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/categories?post=1650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/tags?post=1650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}