The version of MySQL installed on the remote host reportedly allows a remote user to execute arbitrary code by exploiting a buffer overflow in yaSSL 1.7.5 or earlier.

リモートホストにインストールされているバージョンの MySQL により、報告によれば、リモートユーザーが yaSSL 1.7.5 以降においてバッファオーバーフローを悪用することで、任意のコードを実行する可能性があります。

リモートホストにインストールされているMySQL Community Server5.0のバージョンが5.0.66より前です。このようなバージョンは、報告されているところによれば、以下の問題の影響を受けます。

  - FEDERATEDテーブルを使用する場合、リモートサーバーが予想より少ない列の結果を返す場合に、ローカルサーバーが強制的にクラッシュされる可能性があります（バグ#29801）。

  - ALTER VIEW は、他のユーザーにより変更されても元の DEFINER 値を保持することにより、そのユーザーは、ビューのアクセス権を取得できる場合があります（バグ#29908）。

  - ローカルユーザーは、「DATA DIRECTORY」オプションおよび「INDEX DIRECTORY」オプションを使用して、MyISAM テーブルを作成することで権限を回避し、アプリケーションのデータディレクトリの既存のテーブルファイルを上書きできます（バグ#32167）。 

  - DATA/INDEX DIRECTORYを使用してテーブルに対してRENAME TABLEを実行すると、シンボリックリンクが指すファイルが上書きされます（バグ #32111）。

  - 長さが過剰なエラーメッセージを強制することが可能であり、これによりバッファオーバーフローが発生することがありました（バグ #32707）。
 
  - MySQLで使用されるyaSSLバージョン1.7.5以前に存在する3つの脆弱性により、yaSSLが有効で、サーバーでTCP接続が許可されている場合には、認証されていないリモート攻撃者が、サーバーをクラッシュさせたり、任意のコードを実行したりできます（バグ #33814）。

  - SQLステートメントで空のビット文字列リテラル（b''）を使用すると、サーバーがクラッシュする可能性があります（バグ #35658）。

远程主机上安装的 MySQL Community Server 5.0 版本低于 5.0.66。据报告，此类版本受到以下问题的影响：

  - 使用 FEDERATED 表时，如果远程服务器返回的结果包含的列少于预期，则可强制使本地服务器崩溃（错误 #29801）。

  - 即使由其他用户更改，ALTER VIEW 也会保留原始 DEFINER 值，这允许该用户获得该视图的访问权限（错误 #29908）。

  - 本地用户可通过使用“DATA DIRECTORY”和“INDEX DIRECTORY”选项创建 MyISAM 表以覆盖应用程序数据目录中的现有表文件来避开权限（错误 #32167）。 

  - 针对具有 DATA/INDEX DIRECTORY 的表的 RENAME TABLE 会覆盖符号链接指向的文件（错误 #32111）。

  - 可强制执行过长错误消息，这会导致缓冲区溢出（错误 #32707）。
 
  - MySQL 中使用的 yaSSL 1.7.5 及较早版本中的三个漏洞允许未经身份验证的远程攻击者导致服务器崩溃或执行任意代码，但前提是启用了 yaSSL 且服务器支持 TCP 连接（错误 #33814）。

  - SQL 语句中使用的空位字符串文本 (b'') 可导致服务器崩溃（错误 #35658）。

據報，遠端主機上安裝的 MySQL 版本允許遠端使用者惡意利用 yaSSL 1.7.5 或更舊版本中的緩衝區溢位，藉此執行任意程式碼。

据报告，远程主机上安装的 MySQL 版本允许远程用户利用 yaSSL 1.7.5 或更早版本中的缓冲区溢出问题来执行任意代码。

遠端主機上安裝的 MySQL Community Server 5.0 為 5.0.66 之前版本 。據報告，這些版本受到以下問題影響：

  - 使用 FEDERATED 表時，如果遠端伺服器傳回欄數比預期少的結果，本機伺服器將被強制當機 (錯誤 #29801)。

  - ALTER VIEW 將保留原始 DEFINER 值，即使被其他使用者更改亦如此，這會導致該使用者取得檢視存取權 (錯誤 #29908)。

  - 本機使用者可以使用「DATA DIRECTORY」和「INDEX DIRECTORY」選項來建立 MyISAM 資料表，藉此繞過權限控制，覆寫應用程式資料目錄中的現有資料表檔案 (錯誤 #32167)。 

  - 針對具有 DATA / INDEX DIRECTORY 選項的表格執行 RENAME TABLE，可以覆寫符號連結指向的檔案 (錯誤 #32111)。

  - 可以強制使用長度過長的錯誤訊息，這可導致緩衝區溢位 (錯誤 #32707)。
 
  - yaSSL 1.7.5 版和更舊版本 (用於 MySQL) 中有三個弱點，在已啟用 yaSSL 且伺服器允許 TCP 連線的情況下，未經驗證的遠端攻擊者可利用這些弱點造成伺服器當機或執行任意程式碼 (錯誤 #33814)。

  - SQL 陳述式中使用的空位元字串常值 (b'') 可導致伺服器當機 (錯誤 #35658)。

Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232)

Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges.
This issue does not affect Ubuntu 7.10. (CVE-2007-2692)

Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303)

Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL Community Server 5.0 installed on the remote host is before 5.0.66.  Such versions are reportedly affected by the following issues :

  - When using a FEDERATED table, a local server could be     forced to crash if the remote server returns a result     with fewer columns than expected (Bug #29801).

  - ALTER VIEW retains the original DEFINER value, even     when altered by another user, which could allow that     user to gain the access rights of the view (Bug     #29908).

  - A local user can circumvent privileges through creation     of MyISAM tables using the 'DATA DIRECTORY' and 'INDEX     DIRECTORY' options to overwrite existing table files in     the application's data directory (Bug #32167). 

  - RENAME TABLE against a table with DATA/INDEX DIRECTORY     overwrites the file to which the symlink points (Bug     #32111).

  - It was possible to force an error message of excessive     length, which could lead to a buffer overflow (Bug     #32707).
 
  - Three vulnerabilities in yaSSL versions 1.7.5 and     earlier as used in MySQL could allow an unauthenticated     remote attacker to crash the server or to execute     arbitrary code provided yaSSL is enabled and the server     allows TCP connections (Bug #33814).

  - An empty bit-string literal (b'') used in a SQL statement     could result in a server crash (Bug #35658).

Multiple buffer overflows in yaSSL, which is used in MySQL, allowed remote attackers to execute arbitrary code (CVE-2008-0226) or cause a denial of service via a special Hello packet (CVE-2008-0227).

Sergei Golubchik found that MySQL did not properly validate optional data or index directory paths given in a CREATE TABLE statement; as well it would not, under certain conditions, prevent two databases from using the same paths for data or index files. This could allow an authenticated user with appropriate privilege to create tables in one database to read and manipulate data in tables later created in other databases, regardless of GRANT privileges (CVE-2008-2079).

The updated packages have been patched to correct these issues.

Luigi Auriemma discovered two buffer overflows in YaSSL, an SSL implementation included in the MySQL database package, which could lead to denial of service and possibly the execution of arbitrary code.

USN-588-1 fixed vulnerabilities in MySQL. In fixing CVE-2007-2692 for Ubuntu 6.06, additional improvements were made to make privilege checks more restictive. As a result, an upstream bug was exposed which could cause operations on tables or views in a different database to fail. This update fixes the problem.

We apologize for the inconvenience.

Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232)

Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges. This issue does not affect Ubuntu 7.10. (CVE-2007-2692)

Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303)

Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-007 applied. 

This security update contains fixes for the following products :

  - Apache
  - Certificates
  - ClamAV
  - ColorSync
  - CUPS
  - Finder
  - launchd
  - libxslt
  - MySQL Server
  - Networking
  - PHP
  - Postfix
  - PSNormalizer
  - QuickLook
  - rlogin
  - Script Editor
  - Single Sign-On
  - Tomcat
  - vim
  - Weblog

ID	名稱	產品	系列	已發布	已更新	嚴重性
17814	yaSSL 1.7.5 Buffer Overflow	Nessus	Databases	2012/1/16	2018/11/15	high
17814	yaSSL 1.7.5 バッファオーバーフロー	Nessus	Databases	2012/1/16	2018/11/15	high
34159	MySQL Community Server 5.0 < 5.0.67 複数の脆弱性	Nessus	Databases	2008/9/11	2018/11/15	high
34159	MySQL Community Server 5.0 < 5.0.67 多种漏洞	Nessus	Databases	2008/9/11	2018/11/15	high
17814	yaSSL 1.7.5 緩衝區溢位	Nessus	Databases	2012/1/16	2018/11/15	high
17814	yaSSL 1.7.5 缓冲区溢出	Nessus	Databases	2012/1/16	2018/11/15	high
34159	MySQL Community Server 5.0 < 5.0.67 多個弱點	Nessus	Databases	2008/9/11	2018/11/15	high
31638	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mysql-dfsg-5.0 vulnerabilities (USN-588-1)	Nessus	Ubuntu Local Security Checks	2008/3/21	2021/1/19	high
34159	MySQL Community Server 5.0 < 5.0.67 Multiple Vulnerabilities	Nessus	Databases	2008/9/11	2018/11/15	high
36561	Mandriva Linux Security Advisory : mysql (MDVSA-2008:150)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	high
30125	Debian DSA-1478-1 : mysql-dfsg-5.0 - buffer overflows	Nessus	Debian Local Security Checks	2008/1/30	2021/1/4	high
31783	Ubuntu 6.06 LTS : mysql-dfsg-5.0 regression (USN-588-2)	Nessus	Ubuntu Local Security Checks	2008/4/4	2021/1/19	high
34374	Mac OS X Multiple Vulnerabilities (Security Update 2008-007)	Nessus	MacOS X Local Security Checks	2008/10/10	2024/5/28	critical

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

critical