Two vulnerabilities have been discovered in mysql, a common database system. Two scripts contained in the package don't create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking the MySQL server, which is often the root user. The Common Vulnerabilities and Exposures identifies the following problems :

  - CAN-2004-0381     The script mysqlbug in MySQL allows local users to     overwrite arbitrary files via a symlink attack.

  - CAN-2004-0388

    The script mysqld_multi in MySQL allows local users to     overwrite arbitrary files via a symlink attack.

リモートホストにインストールされている MySQL のバージョンが、 4.0.20 より前のものです。ローカルの攻撃者は mysqlbug の欠陥を悪用して、シンボリックリンク攻撃を通して任意のファイルを上書きする可能性があります。

远程主机上安装的 MySQL 版本低于 4.0.20。本地攻击者可利用 mysqlbug 中的一个缺陷，通过符号链接攻击来覆盖任意文件。

遠端主機上安裝的 MySQL 版本比 4.0.20 舊。本機攻擊者可惡意利用 mysqlbug 中的一個瑕疵，透過符號連結攻擊覆寫任意檔案。

Updated mysql packages that fix various temporary file security issues, as well as a number of bugs, are now available.

MySQL is a multi-user, multi-threaded SQL database server.

This update fixes a number of small bugs, including some potential security problems associated with careless handling of temporary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0381, CVE-2004-0388, and CVE-2004-0457 to these issues.

A number of additional security issues that affect mysql have been corrected in the source package. These include CVE-2004-0835, CVE-2004-0836, CVE-2004-0837, and CVE-2004-0957. Red Hat Enterprise Linux 3 does not ship with the mysql-server package and is therefore not affected by these issues.

This update also allows 32-bit and 64-bit libraries to be installed concurrently on the same system.

All users of mysql should upgrade to these updated packages, which resolve these issues.

The remote host is affected by the vulnerability described in GLSA-200405-20 (Insecure Temporary File Creation In MySQL)

    The MySQL bug reporting utility (mysqlbug) creates a temporary file to log     bug reports to. A malicious local user with write access to the /tmp     directory could create a symbolic link of the name mysqlbug-N     pointing to a protected file, such as /etc/passwd, such that when mysqlbug     creates the Nth log file, it would end up overwriting the target     file. A similar vulnerability exists with the mysql_multi utility, which     creates a temporary file called mysql_multi.log.
  Impact :

    Since mysql_multi runs as root, a local attacker could use this to destroy     any other users' data or corrupt and destroy system files.
  Workaround :

    One could modify both scripts to log to a directory that users do not have     write permission to, such as /var/log/mysql/.

The version of MySQL installed on the remote host is older than 4.0.20.  A local attacker could exploit a flaw in mysqlbug to overwite arbitrary files via a symlink attack.

Shaun Colley reports that the script `mysqlbug' included with MySQL sometimes creates temporary files in an unsafe manner. As a result, an attacker may create a symlink in /tmp so that if another user invokes `mysqlbug' and quits without making any changes, an arbitrary file may be overwritten with the bug report template.

Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1.

MySQL is a multi-user, multi-threaded SQL database server.

A number security issues that affect the mysql server have been reported :

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Additionally, the following minor temporary file vulnerabilities were discovered :

  - Stan Bubroski and Shaun Colley found a temporary file     vulnerability in the mysqlbug script (CVE-2004-0381). -     A temporary file vulnerability was discovered in     mysqld_multi (CVE-2004-0388). - Jeroen van Wolffelaar     discovered an temporary file vulnerability in the     mysqlhotcopy script when using the scp method     (CVE-2004-0457).

All users of mysql should upgrade to these updated packages, which resolve these issues and also include fixes for a number of small bugs.

Shaun Colley discovered that two scripts distributed with MySQL, the 'mysqld_multi' and 'mysqlbug' scripts, did not create temporary files in a secure fashion. An attacker could create symbolic links in /tmp that could allow for overwriting of files with the privileges of the user running the scripts.

The scripts have been patched in the updated packages to prevent this behaviour.

ID	名稱	產品	系列	已發布	已更新	嚴重性
15320	Debian DSA-483-1 : mysql - insecure temporary file creation	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	low
17823	MySQL < 4.0.20 ファイルの上書き	Nessus	Databases	2012/1/18	2018/11/15	low
17823	MySQL < 4.0.20 文件覆盖	Nessus	Databases	2012/1/18	2018/11/15	low
17823	MySQL < 4.0.20 檔案覆寫	Nessus	Databases	2012/1/18	2018/11/15	low
15534	RHEL 3 : mysql (RHSA-2004:569)	Nessus	Red Hat Local Security Checks	2004/10/21	2021/1/14	medium
14506	GLSA-200405-20 : Insecure Temporary File Creation In MySQL	Nessus	Gentoo Local Security Checks	2004/8/30	2021/1/6	low
17823	MySQL < 4.0.20 File Overwrite	Nessus	Databases	2012/1/18	2018/11/15	low
37467	FreeBSD : MySQL insecure temporary file creation (mysqlbug) (2e129846-8fbb-11d8-8b29-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	2009/4/23	2021/1/6	low
15536	RHEL 2.1 : mysql (RHSA-2004:597)	Nessus	Red Hat Local Security Checks	2004/10/21	2021/1/14	critical
14133	Mandrake Linux Security Advisory : MySQL (MDKSA-2004:034)	Nessus	Mandriva Local Security Checks	2004/7/31	2021/1/6	low

偵測

搜尋 Plugin

low

low

low

low

medium

low

low

low

critical

low