已发现在 MySQL 数据库服务器中存在多个问题。已通过将 MySQL 升级到新的上游版本 5.5.33 来解决这些漏洞，该版本包含更多变更，例如性能改进、缺陷补丁、新功能并可能包含不兼容的变更。请参阅 MySQL 5.5 发行说明以了解更多详细信息：

- http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html - http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-33.html

此外，此更新修复两个专门影响 mysql-5.5 Debian 程序包的问题：

mysql-server-5.5 程序包的 post-installation 脚本中的争用条件在限制权限之前以全局可读权限创建配置文件“/etc/mysql/debian.cnf”，这样允许本地用户读取该文件并获取 debian-sys-maint 的凭据等敏感信息以便执行管理任务。(CVE-2013-2162)

Matthias Reichl 报告称 mysql-5.5 程序包遗漏之前在 Debian 的 mysql-5.1 中应用的修补程序，这些修补程序用于终止数据库“test”和允许在无密码情况下从 localhost 到“test”数据库及任何以“test_”开头的数据库的匿名访问的权限。此更新重新引入 mysql-5.5 程序包的这些修补程序。

未涉及现有数据库和权限。请参阅随此更新提供的 NEWS 文件以了解更多信息。

远程 Solaris 系统缺少用于处理安全更新的必要修补程序：

- 5.0.67 之前的 MySQL 允许本地用户通过在包含经修改的 (1) DATA DIRECTORY 或 (2) INDEX DIRECTORY 参数的 MyISAM 表上调用 CREATE TABLE 来绕过某些权限检查，这些参数最初与无符号链接的路径名相关联，并且可以指向在未来的某个时间创建的表，在该时间，路径名被改成包含 MySQL 数据主目录中某个子目录的符号链接。注意：存在此漏洞的原因是对 CVE-2008-4097 的修复不完整。(CVE-2008-4098)

- MySQL 5.0.x 至 5.0.88、5.1.x 至 5.1.41 以及 6.0.9-alpha 之前的 6.0 中的 sql/sql_table.cc，当数据主目录包含不同文件系统的符号链接时，允许经过认证的远程用户引用需要跟随此符号链接的 (1) DATA DIRECTORY 或 (2) INDEX DIRECTORY 参数来调用 CREATE TABLE，从而绕过预期访问限制。(CVE-2008-7247)

- 5.1.46 之前的 MySQL 允许本地用户结合符号链接攻击和 DROP TABLE 命令来删除其他用户 MyISAM 表的数据和索引文件，此漏洞与 CVE-2008-4098 及 CVE-2008-7247 不同。(CVE-2010-1626)

- 5.5.30 之前的 MariaDB 5.5.x、5.3.13 之前的 MariaDB 5.3.x、5.2.15 之前的 MariaDB 5.2.x以及 5.1.68 之前的 MariaDB 5.1.x，以及 Oracle MySQL 5.1.69 和更早版本、5.5.31 和更早版本、5.6.11 和更早版本，允许远程攻击者通过指定大量点的构建的几何功能造成拒绝服务（崩溃），在处理此功能的二进制形式时此功能得不到正确处理，与数值计算错误相关。(CVE-2013-1861)

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.70 in Ubuntu 10.04 LTS. Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.04 have been updated to MySQL 5.5.32.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.
html.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.5.33, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes for further details :

  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     32.html
  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     33.html

In addition this update fixes two issues affecting specifically the mysql-5.5 Debian package :

A race condition in the post-installation script of the mysql-server-5.5 package creates the configuration file '/etc/mysql/debian.cnf' with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as credentials for the debian-sys-maint to perform administration tasks. (CVE-2013-2162 )

Matthias Reichl reported that the mysql-5.5 package misses the patches applied previous in Debian's mysql-5.1 to drop the database 'test' and the permissions that allow anonymous access, without a password, from localhost to the 'test' database and any databases starting with'test_'. This update reintroduces these patches for the mysql-5.5 package.

Existing databases and permissions are not touched. Please refer to the NEWS file provided with this update for further information.

The remote Solaris system is missing necessary patches to address security updates :

  - MySQL before 5.0.67 allows local users to bypass certain     privilege checks by calling CREATE TABLE on a MyISAM     table with modified (1) DATA DIRECTORY or (2) INDEX     DIRECTORY arguments that are originally associated with     pathnames without symlinks, and that can point to tables     created at a future time at which a pathname is modified     to contain a symlink to a subdirectory of the MySQL home     data directory. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2008-4097. (CVE-2008-4098)

  - sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x     through 5.1.41, and 6.0 before 6.0.9-alpha, when the     data home directory contains a symlink to a different     filesystem, allows remote authenticated users to bypass     intended access restrictions by calling CREATE TABLE     with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY     argument referring to a subdirectory that requires     following this symlink. (CVE-2008-7247)

  - MySQL before 5.1.46 allows local users to delete the     data and index files of another user's MyISAM table via     a symlink attack in conjunction with the DROP TABLE     command, a different vulnerability than CVE-2008-4098     and CVE-2008-7247. (CVE-2010-1626)

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x     before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL     5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and     earlier allows remote attackers to cause a denial of     service (crash) via a crafted geometry feature that     specifies a large number of points, which is not     properly handled when processing the binary     representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

This is an update that uses /var/tmp as default tmpdir to prevent potential issues, fixes CVE-2013-1861 and adds some missing command-line options to man-pages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL installed on the remote host is earlier than 5.6.12. Therefore, affected by vulnerabilities in the following components :

 - Audit Log

  - Data Manipulation Language

  - Full Text Search

  - GIS

  - InnoDB

  - MemCached

  - Server Optimizer

  - Server Privileges

  - Server Replication

  - XA Transactions

  - 'Server Options' sub component (for MySQL versions earlier than and up to 5.5.30, as well as 5.6.10)

  - The 'Prepared Statements' sub component (for MySQL versions earlier than and up to 5.5.30, as well as 5.6.10)

ID	名稱	產品	系列	已發布	已更新	嚴重性
71474	Debian DSA-2818-1：mysql-5.5 - 多个漏洞	Nessus	Debian Local Security Checks	2013/12/17	2021/1/11	medium
80705	Oracle Solaris 第三方修补程序更新：mysql (multiple_vulnerabilities_in_mysql)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
69073	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : mysql-5.5, mysql-dfsg-5.1 vulnerabilities (USN-1909-1)	Nessus	Ubuntu Local Security Checks	2013/7/26	2019/9/19	medium
71474	Debian DSA-2818-1 : mysql-5.5 - several vulnerabilities	Nessus	Debian Local Security Checks	2013/12/17	2021/1/11	medium
80705	Oracle Solaris Third-Party Patch Update : mysql (multiple_vulnerabilities_in_mysql)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
67261	Fedora 19 : community-mysql-5.5.31-7.fc19 (2013-10020)	Nessus	Fedora Local Security Checks	2013/7/12	2021/1/11	medium
6934	Oracle MySQL 5.6.x < 5.6.12 Multiple Vulnerabilities	Nessus Network Monitor	Database	2013/7/22	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium