(Red Hat Issues Fix) MySQL May Let Remote Authenticated Users Access Restricted Tables or Crash the System
|
|
SecurityTracker Alert ID: 1011821 |
|
SecurityTracker URL: http://securitytracker.com/id/1011821
|
|
CVE Reference:
CVE-2004-0835, CVE-2004-0837
(Links to External Site)
|
Date: Oct 20 2004
|
Impact:
Denial of service via network, User access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 3.23
|
Description:
Two vulnerabilities were reported in MySQL. A remote authenticated user may be able to gain elevated privileges. A remote authenticated user may be able to cause denial of service conditions.
In March 2004, Oleksandr Byelkin reported that an 'alter table [...] rename [...]' command will check the create/insert rights of the old table instead of the new table [CVE: CAN-2004-0835]. As a result, a user may be able to gain access to tables that the user is not authorized to access.
In January 2004, Dean Ellis reported that if multiple threads issue 'alter' commands against 'merge' tables to modify the 'union', the target server may crash [CVE: CAN-2004-0837].
The original bug reports are available at:
http://bugs.mysql.com/bug.php?id=3270
http://bugs.mysql.com/bug.php?id=2408
|
Impact:
A remote authenticated user may be able to gain elevated privileges.
A remote authenticated user may be able to cause denial of service conditions.
|
Solution:
Red Hat has released a fix.
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/mysql-3.23.58-1.72.1.src.rpm
1a6ad34678d35aa5c1bfba0ff7290c44 mysql-3.23.58-1.72.1.src.rpm
i386:
a33c7efe12e0a4b0dade197a823a5e42 mysql-3.23.58-1.72.1.i386.rpm
3b0621721b68c67f3d73681c9fbade09 mysql-devel-3.23.58-1.72.1.i386.rpm
63280ad1d2b39d5865a209e2822cec5e mysql-server-3.23.58-1.72.1.i386.rpm
ia64:
73b97bae08854a6bbd25a8ad0e057666 mysql-3.23.58-1.72.1.ia64.rpm
709aff64529b31c9dc3ade3017509d44 mysql-devel-3.23.58-1.72.1.ia64.rpm
311db47abcc5cc79b094804c5b3912f4 mysql-server-3.23.58-1.72.1.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/mysql-3.23.58-1.72.1.src.rpm
1a6ad34678d35aa5c1bfba0ff7290c44 mysql-3.23.58-1.72.1.src.rpm
ia64:
73b97bae08854a6bbd25a8ad0e057666 mysql-3.23.58-1.72.1.ia64.rpm
709aff64529b31c9dc3ade3017509d44 mysql-devel-3.23.58-1.72.1.ia64.rpm
311db47abcc5cc79b094804c5b3912f4 mysql-server-3.23.58-1.72.1.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/mysql-3.23.58-1.72.1.src.rpm
1a6ad34678d35aa5c1bfba0ff7290c44 mysql-3.23.58-1.72.1.src.rpm
i386:
a33c7efe12e0a4b0dade197a823a5e42 mysql-3.23.58-1.72.1.i386.rpm
3b0621721b68c67f3d73681c9fbade09 mysql-devel-3.23.58-1.72.1.i386.rpm
63280ad1d2b39d5865a209e2822cec5e mysql-server-3.23.58-1.72.1.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/mysql-3.23.58-1.72.1.src.rpm
1a6ad34678d35aa5c1bfba0ff7290c44 mysql-3.23.58-1.72.1.src.rpm
i386:
a33c7efe12e0a4b0dade197a823a5e42 mysql-3.23.58-1.72.1.i386.rpm
3b0621721b68c67f3d73681c9fbade09 mysql-devel-3.23.58-1.72.1.i386.rpm
63280ad1d2b39d5865a209e2822cec5e mysql-server-3.23.58-1.72.1.i386.rpm
|
Vendor URL: www.mysql.com/ (Links to External Site)
|
Cause:
Access control error, Exception handling error, State error
|
Underlying OS:
Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Wed, 20 Oct 2004 15:47 -0400
Subject: [RHSA-2004:597-01] Updated mysql packages fix security issues and
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated mysql packages fix security issues and bugs
Advisory ID: RHSA-2004:597-01
Issue date: 2004-10-20
Updated on: 2004-10-20
Product: Red Hat Enterprise Linux
Obsoletes: RHSA-2003:282
CVE Names: CAN-2004-0381 CAN-2004-0388 CAN-2004-0457 CAN-2004-0835 CAN-2004-0836 CAN-2004-0837 CAN-2004-0957
- ---------------------------------------------------------------------
1. Summary:
Updated mysql packages that fix various security issues, as well as a
number of bugs, are now available for Red Hat Enterprise Linux 2.1.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
3. Problem description:
MySQL is a multi-user, multi-threaded SQL database server.
A number security issues that affect the mysql server have been reported:
Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked
the CREATE/INSERT rights of the old table instead of the new one. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2004-0835 to this issue.
Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect
function. In order to exploit this issue an attacker would need to force
the use of a malicious DNS server (CAN-2004-0836).
Dean Ellis discovered that multiple threads ALTERing the same (or
different) MERGE tables to change the UNION could cause the server to crash
or stall (CAN-2004-0837).
Sergei Golubchik discovered that if a user is granted privileges to a
database with a name containing an underscore ("_"), the user also gains
the ability to grant privileges to other databases with similar names
(CAN-2004-0957).
Additionally, the following minor temporary file vulnerabilities were
discovered:
- - Stan Bubroski and Shaun Colley found a temporary file vulnerability in
the mysqlbug script (CAN-2004-0381).
- - A temporary file vulnerability was discovered in mysqld_multi
(CAN-2004-0388).
- - Jeroen van Wolffelaar discovered an temporary file vulnerability in the
mysqlhotcopy script when using the scp method (CAN-2004-0457).
All users of mysql should upgrade to these updated packages, which resolve
these issues and also include fixes for a number of small bugs.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info):
112693 - mysqlhotcopy of local Fedora DB broken after upgrade from RH9
113960 - [PATCH] Bug fix + enhancement for mysql_setpermission
115165 - botched string concat ?
124352 - Cannot drop databases
129409 - linking with 'mysql --libs' doesent seem to work correctly.
130348 - CAN-2004-0457 mysqlhotcopy insecure temporary file vulnerability
135372 - CAN-2004-0835 MySQL flaws (CAN-2004-0836, CAN-2004-0837, CAN-2004-0957)
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/mysql-3.23.58-1.72.1.src.rpm
1a6ad34678d35aa5c1bfba0ff7290c44 mysql-3.23.58-1.72.1.src.rpm
i386:
a33c7efe12e0a4b0dade197a823a5e42 mysql-3.23.58-1.72.1.i386.rpm
3b0621721b68c67f3d73681c9fbade09 mysql-devel-3.23.58-1.72.1.i386.rpm
63280ad1d2b39d5865a209e2822cec5e mysql-server-3.23.58-1.72.1.i386.rpm
ia64:
73b97bae08854a6bbd25a8ad0e057666 mysql-3.23.58-1.72.1.ia64.rpm
709aff64529b31c9dc3ade3017509d44 mysql-devel-3.23.58-1.72.1.ia64.rpm
311db47abcc5cc79b094804c5b3912f4 mysql-server-3.23.58-1.72.1.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/mysql-3.23.58-1.72.1.src.rpm
1a6ad34678d35aa5c1bfba0ff7290c44 mysql-3.23.58-1.72.1.src.rpm
ia64:
73b97bae08854a6bbd25a8ad0e057666 mysql-3.23.58-1.72.1.ia64.rpm
709aff64529b31c9dc3ade3017509d44 mysql-devel-3.23.58-1.72.1.ia64.rpm
311db47abcc5cc79b094804c5b3912f4 mysql-server-3.23.58-1.72.1.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/mysql-3.23.58-1.72.1.src.rpm
1a6ad34678d35aa5c1bfba0ff7290c44 mysql-3.23.58-1.72.1.src.rpm
i386:
a33c7efe12e0a4b0dade197a823a5e42 mysql-3.23.58-1.72.1.i386.rpm
3b0621721b68c67f3d73681c9fbade09 mysql-devel-3.23.58-1.72.1.i386.rpm
63280ad1d2b39d5865a209e2822cec5e mysql-server-3.23.58-1.72.1.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/mysql-3.23.58-1.72.1.src.rpm
1a6ad34678d35aa5c1bfba0ff7290c44 mysql-3.23.58-1.72.1.src.rpm
i386:
a33c7efe12e0a4b0dade197a823a5e42 mysql-3.23.58-1.72.1.i386.rpm
3b0621721b68c67f3d73681c9fbade09 mysql-devel-3.23.58-1.72.1.i386.rpm
63280ad1d2b39d5865a209e2822cec5e mysql-server-3.23.58-1.72.1.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key.html#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0381
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0388
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0457
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0835
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0836
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0837
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0957
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact.html
Copyright 2004 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQFBdsDnXlSAg2UNWIIRArmMAJ44yYqEYMrzgkmRFZY7455sPg8W6ACdGITG
9Sw5OczEVx/gi22kQd76hfo=
=Q/TC
-----END PGP SIGNATURE-----
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
|
|
