Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1.

MySQL is a multi-user, multi-threaded SQL database server.

A number security issues that affect the mysql server have been reported :

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Additionally, the following minor temporary file vulnerabilities were discovered :

  - Stan Bubroski and Shaun Colley found a temporary file     vulnerability in the mysqlbug script (CVE-2004-0381). -     A temporary file vulnerability was discovered in     mysqld_multi (CVE-2004-0388). - Jeroen van Wolffelaar     discovered an temporary file vulnerability in the     mysqlhotcopy script when using the scp method     (CVE-2004-0457).

All users of mysql should upgrade to these updated packages, which resolve these issues and also include fixes for a number of small bugs.

The remote host is affected by the vulnerability described in GLSA-200410-22 (MySQL: Multiple vulnerabilities)

    The following vulnerabilities were found and fixed in MySQL:
    Oleksandr Byelkin found that ALTER TABLE ... RENAME checks CREATE/INSERT     rights of the old table instead of the new one (CAN-2004-0835). Another     privilege checking bug allowed users to grant rights on a database they had     no rights on.
    Dean Ellis found a defect where multiple threads ALTERing the MERGE tables     to change the UNION could cause the server to crash (CAN-2004-0837).
    Another crash was found in MATCH ... AGAINST() queries with missing closing     double quote.
    Finally, a buffer overrun in the mysql_real_connect function was found by     Lukasz Wojtow (CAN-2004-0836).
  Impact :

    The privilege checking issues could be used by remote users to bypass their     rights on databases. The two crashes issues could be exploited by a remote     user to perform a Denial of Service attack on MySQL server. The buffer     overrun issue could also be exploited as a Denial of Service attack, and     may allow to execute arbitrary code with the rights of the MySQL daemon     (typically, the 'mysql' user).
  Workaround :

    There is no known workaround at this time.

リモートホストは、4.0.21より古いバージョンのMySQLを実行しています。

MySQLは、Linux/BSDおよびWindowsプラットフォームの両方で実行されるデータベースです。
このバージョンは、mysql_real_connect()関数内の長さオーバーフローに対して脆弱です。このオーバーフローは、返されたドメイン（DNS）レコードの処理におけるエラーが原因です。この欠陥を悪用する攻撃者は、MySQLサーバーからクエリされるDNSサーバーを制御する必要があります。攻撃が成功すると、攻撃者はリモートマシンで任意のコードを実行できるようになります。

遠端主機正在執行的 MySQL 是 4.0.21 之前版本。

MySQL 是在 Linux/BSD 和 Windows 平台上執行的資料庫。
此版本容易受到其 mysql_real_connect() 函式中的長度溢位弱點影響。造成溢位的原因在於，應用程式在處理傳回網域 (DNS) 記錄時發生錯誤。攻擊者若要惡意利用此瑕疵，必須控制由 MySQL 伺服器查詢的 DNS 伺服器。若攻擊成功，攻擊者將能夠在遠端計算機上執行任意程式碼。

远程主机运行的 MySQL 版本低于 4.0.21。

MySQL 是在 Linux/BSD 和 Windows 平台上都能运行的数据库。
此版本容易受到其 mysql_real_connect() 函数中长度溢出漏洞的影响。溢出是处理返回域 (DNS) 记录时发生错误所致。利用此缺陷的攻击者需要控制经 MySQL 服务器查询的 DNS 服务器。若成功利用此漏洞，攻击者便可在远程计算机上执行任意代码。

The remote host is running a version of MySQL that is older than 4.0.21.

MySQL is a database that runs on both Linux/BSD and Windows platforms.
This version is vulnerable to a length overflow within it's mysql_real_connect() function.  The overflow is due to an error in the processing of a return Domain (DNS) record.  An attacker, exploiting this flaw, would need to control a DNS server, which would be queried by the MySQL server.  A successful attack would give the attacker the ability to execute arbitrary code on the remote machine.

An updated mysql-server package that fixes various security issues is now available in the Red Hat Enterprise Linux 3 Extras channel of Red Hat Network.

MySQL is a multi-user, multi-threaded SQL database server.

A number of security issues that affect the mysql-server package have been reported. Although Red Hat Enterprise Linux 3 does not ship with the mysql-server package, the affected package is available from the Red Hat Network Extras channel.

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Users of mysql-server should upgrade to these erratum packages, which correct these issues.

Several problems have been discovered in MySQL, a commonly used SQL database on Unix servers. The following problems have been identified by the Common Vulnerabilities and Exposures Project :

  - CAN-2004-0835     Oleksandr Byelkin noticed that ALTER TABLE ... RENAME     checks CREATE/INSERT rights of the old table instead of     the new one.

  - CAN-2004-0836

    Lukasz Wojtow noticed a buffer overrun in the     mysql_real_connect function.

  - CAN-2004-0837

    Dean Ellis noticed that multiple threads ALTERing the     same (or different) MERGE tables to change the UNION can     cause the server to crash or stall.

A number of problems have been discovered in the MySQL database server :

Jeroen van Wolffelaar discovered an insecure temporary file vulnerability in the mysqlhotcopy script when using the scp method (CVE-2004-0457).

Oleksandr Byelkin discovered that the 'ALTER TABLE ... RENAME' would check the CREATE/INSERT rights of the old table rather than the new one (CVE-2004-0835).

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION can cause the server to crash or stall (CVE-2004-0837).

The updated MySQL packages have been patched to protect against these issues.

The mysql_real_connect function doesn't properly handle DNS replies by copying the IP address into a buffer without any length checking. A specially crafted DNS reply may therefore be used to cause a buffer overflow on affected systems.

Note that whether this issue can be exploitable depends on the system library responsible for the gethostbyname function. The bug finder, Lukasz Wojtow, explaines this with the following words :

In glibc there is a limitation for an IP address to have only 4 bytes (obviously), but generally speaking the length of the address comes with a response for dns query (i know it sounds funny but read rfc1035 if you don't believe). This bug can occur on libraries where gethostbyname function takes length from dns's response

Several vulnerabilities have been discovered in the MySQL database server.

Lukasz Wojtow discovered a potential buffer overflow in the function mysql_real_connect(). A malicious name server could send specially crafted DNS packages which might result in execution of arbitrary code with the database server's privileges. However, it is believed that this bug cannot be exploited with the C Standard library (glibc) that Ubuntu uses. (CAN-2004-0836).

Dean Ellis noticed a flaw that allows an authorized MySQL user to cause a denial of service (crash or hang) via concurrent execution of certain statements (ALTER TABLE ... UNION=, FLUSH TABLES) on tables of type MERGE (CAN-2004-0837)

Some query strings containing a double quote (like MATCH ... AGAINST (' some ' query' IN BOOLEAN MODE) ) that did not have a matching closing double quote caused a denial of service (server crash). Again, this is only exploitable by authorized mysql users. (CAN-2004-0956)

If a user was granted privileges to a database with a name containing an underscore ('_'), the user also gained the ability to grant privileges to other databases with similar names. (CAN-2004-0957).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
15536	RHEL 2.1 : mysql (RHSA-2004:597)	Nessus	Red Hat Local Security Checks	2004/10/21	2021/1/14	critical
15558	GLSA-200410-22 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2004/10/25	2021/1/6	critical
14319	MySQL < 4.0.21 mysql_real_connect()関数のリモートオーバーフロー	Nessus	Databases	2004/8/20	2018/7/16	critical
14319	MySQL < 4.0.21 mysql_real_connect() 函式遠端溢位	Nessus	Databases	2004/8/20	2018/7/16	critical
14319	MySQL < 4.0.21 mysql_real_connect() 函数远程溢出	Nessus	Databases	2004/8/20	2018/7/16	critical
14319	MySQL < 4.0.21 mysql_real_connect() Function Remote Overflow	Nessus	Databases	2004/8/20	2018/7/16	critical
15631	RHEL 3 : mysql-server (RHSA-2004:611)	Nessus	Red Hat Local Security Checks	2004/11/4	2021/1/14	critical
15660	Debian DSA-562-1 : mysql - several vulnerabilities	Nessus	Debian Local Security Checks	2004/11/10	2021/1/4	critical
15599	Mandrake Linux Security Advisory : MySQL (MDKSA-2004:119)	Nessus	Mandriva Local Security Checks	2004/11/2	2021/1/6	critical
19009	FreeBSD : mysql -- mysql_real_connect buffer overflow vulnerability (835256b8-46ed-11d9-8ce0-00065be4b5b6)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	critical
20648	Ubuntu 4.10 : mysql-dfsg vulnerabilities (USN-32-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical