CVE-2002-1373 in MySQL
Summary
by MITRE
Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of service (crash or hang) in mysqld by causing large negative integers to be provided to a memcpy call.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/12/2019
The vulnerability identified as CVE-2002-1373 represents a critical signed integer overflow issue within the MySQL database management system's COM_TABLE_DUMP package. This flaw exists in MySQL versions 3.23.x prior to 3.23.54 and demonstrates a classic buffer management vulnerability that can be exploited remotely to execute denial of service attacks against database servers. The vulnerability specifically targets the mysqld daemon's handling of integer values during memory operations, creating a scenario where malicious input can cause system instability and complete service disruption.
The technical root cause of this vulnerability lies in how the COM_TABLE_DUMP functionality processes integer parameters within the memcpy system call. When attackers provide large negative integers as input parameters, the signed integer handling causes arithmetic overflow conditions that result in invalid memory access patterns. This occurs because the system fails to properly validate integer inputs before passing them to memory manipulation functions, leading to situations where the memcpy operation attempts to copy data to invalid memory locations or with negative size parameters. The vulnerability manifests as a crash or hang condition in the mysqld process, effectively rendering the database service unavailable to legitimate users and applications.
From an operational perspective, this vulnerability presents significant risk to database server availability and system integrity. Attackers can remotely exploit this flaw without requiring authentication, making it particularly dangerous in networked environments where database servers are accessible from external networks. The impact extends beyond simple service disruption as the vulnerability can cause complete system hangs that require manual intervention to restore service. This type of denial of service attack can be particularly damaging in production environments where database availability is critical for business operations, potentially causing cascading failures across dependent systems and applications that rely on database connectivity.
The vulnerability aligns with CWE-190, which specifically addresses integer overflow conditions, and demonstrates characteristics consistent with ATT&CK technique T1499.004 for network denial of service attacks. Organizations running affected MySQL versions should immediately implement mitigations including patching to MySQL 3.23.54 or later, implementing network segmentation to limit access to database servers, and deploying intrusion detection systems to monitor for suspicious integer parameter patterns. Additionally, input validation controls should be strengthened at all application interfaces that interact with database systems to prevent malformed integer values from reaching core database engine functions. The security community should also consider implementing automated monitoring solutions that can detect anomalous integer parameter values that might indicate exploitation attempts against similar vulnerabilities in other database systems and software components.