You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

82 lines
2.8 KiB

<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200804-04">
<title>MySQL: Multiple vulnerabilities</title>
<synopsis>
Multiple vulnerabilities in MySQL might lead to privilege escalation and
Denial of Service.
</synopsis>
<product type="ebuild">mysql</product>
<announced>April 06, 2008</announced>
<revised>April 06, 2008: 01</revised>
<bug>201669</bug>
<access>remote</access>
<affected>
<package name="dev-db/mysql" auto="yes" arch="*">
<unaffected range="ge">5.0.54</unaffected>
<vulnerable range="lt">5.0.54</vulnerable>
</package>
</affected>
<background>
<p>
MySQL is a popular multi-threaded, multi-user SQL server.
</p>
</background>
<description>
<p>
Multiple vulnerabilities have been reported in MySQL:
</p>
<ul>
<li>Mattias Jonsson reported that a "RENAME TABLE" command against a
table with explicit "DATA DIRECTORY" and "INDEX DIRECTORY" options
would overwrite the file to which the symlink points
(CVE-2007-5969).</li>
<li>Martin Friebe discovered that MySQL does not
update the DEFINER value of a view when the view is altered
(CVE-2007-6303).</li>
<li>Philip Stoev discovered that the federated
engine expects the response of a remote MySQL server to contain a
minimum number of columns in query replies (CVE-2007-6304).</li>
</ul>
</description>
<impact type="normal">
<p>
An authenticated remote attacker could exploit the first vulnerability
to overwrite MySQL system tables and escalate privileges, or use the
second vulnerability to gain privileges via an "ALTER VIEW" statement.
Remote federated MySQL servers could cause a Denial of Service in the
local MySQL server by exploiting the third vulnerability.
</p>
</impact>
<workaround>
<p>
There is no known workaround at this time.
</p>
</workaround>
<resolution>
<p>
All MySQL users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=dev-db/mysql-5.0.54&quot;</code>
</resolution>
<references>
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5969">CVE-2007-5969</uri>
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6303">CVE-2007-6303</uri>
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6304">CVE-2007-6304</uri>
</references>
<metadata tag="requester" timestamp="Mon, 28 Jan 2008 18:21:58 +0000">
jaervosz
</metadata>
<metadata tag="bugReady" timestamp="Sat, 09 Feb 2008 20:29:29 +0000">
jaervosz
</metadata>
<metadata tag="submitter" timestamp="Thu, 03 Apr 2008 23:20:56 +0000">
rbu
</metadata>
</glsa>