MDVSA-2009:326

Executive Summary

Informations
Name	MDVSA-2009:326	First vendor Publication	2009-12-07
Vendor	Mandriva	Last vendor Modification	2009-12-07
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:S/C:C/I:C/A:C)
Cvss Base Score	8.5	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	6.8	Authentification	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple vulnerabilities has been found and corrected in mysql:

MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement (CVE-2008-3963).

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097 (CVE-2008-4098).

Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document (CVE-2008-4456).

Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained from third party information (CVE-2009-2446).

Packages for 2008.0 are being provided due to extended support for Corporate products.

This update provides fixes for this vulnerability.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2009:326

CWE : Common Weakness Enumeration

id	Name
CWE-134	Uncontrolled Format String
CWE-264	Permissions, Privileges, and Access Controls
CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting')
CWE-59	Improper Link Resolution Before File Access ('Link Following')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10521

Oval ID:	oval:org.mitre.oval:def:10521
Title:	MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.
Description:	MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-3963	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section mysql is earlier than 0:5.0.77-3.el5 AND mysql-devel is earlier than 0:5.0.77-3.el5 AND mysql-test is earlier than 0:5.0.77-3.el5 AND mysql-bench is earlier than 0:5.0.77-3.el5 AND mysql-server is earlier than 0:5.0.77-3.el5

Definition Id: oval:org.mitre.oval:def:10591

Oval ID:	oval:org.mitre.oval:def:10591
Title:	MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
Description:	MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-4098	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section mysql is earlier than 0:4.1.22-2.el4_8.3 AND mysql-devel is earlier than 0:4.1.22-2.el4_8.3 AND mysql-bench is earlier than 0:4.1.22-2.el4_8.3 AND mysql-server is earlier than 0:4.1.22-2.el4_8.3

Definition Id: oval:org.mitre.oval:def:11456

Oval ID:	oval:org.mitre.oval:def:11456
Title:	Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
Description:	Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-4456	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section mysql is earlier than 0:4.1.22-2.el4_8.3 AND mysql-devel is earlier than 0:4.1.22-2.el4_8.3 AND mysql-bench is earlier than 0:4.1.22-2.el4_8.3 AND mysql-server is earlier than 0:4.1.22-2.el4_8.3 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section mysql is earlier than 0:5.0.77-3.el5 AND mysql-devel is earlier than 0:5.0.77-3.el5 AND mysql-test is earlier than 0:5.0.77-3.el5 AND mysql-bench is earlier than 0:5.0.77-3.el5 AND mysql-server is earlier than 0:5.0.77-3.el5

Definition Id: oval:org.mitre.oval:def:11857

Oval ID:	oval:org.mitre.oval:def:11857
Title:	Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained from third party information.
Description:	Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained from third party information.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2446	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section mysql is earlier than 0:4.1.22-2.el4_8.3 AND mysql-devel is earlier than 0:4.1.22-2.el4_8.3 AND mysql-bench is earlier than 0:4.1.22-2.el4_8.3 AND mysql-server is earlier than 0:4.1.22-2.el4_8.3 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section mysql is earlier than 0:5.0.77-3.el5 AND mysql-devel is earlier than 0:5.0.77-3.el5 AND mysql-test is earlier than 0:5.0.77-3.el5 AND mysql-bench is earlier than 0:5.0.77-3.el5 AND mysql-server is earlier than 0:5.0.77-3.el5

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mysql Mysql cpe:/a:mysql:mysql:6.0.4 cpe:/a:mysql:mysql:6.0.3 cpe:/a:mysql:mysql:6.0.2 cpe:/a:mysql:mysql:6.0.1 cpe:/a:mysql:mysql:6.0.0 cpe:/a:mysql:mysql:5.1.9 cpe:/a:mysql:mysql:5.1.8 cpe:/a:mysql:mysql:5.1.7 cpe:/a:mysql:mysql:5.1.6 cpe:/a:mysql:mysql:5.1.5a cpe:/a:mysql:mysql:5.1.5 cpe:/a:mysql:mysql:5.1.4 cpe:/a:mysql:mysql:5.1.3 cpe:/a:mysql:mysql:5.1.23a cpe:/a:mysql:mysql:5.1.23_bk cpe:/a:mysql:mysql:5.1.23 cpe:/a:mysql:mysql:5.1.22 cpe:/a:mysql:mysql:5.1.21 cpe:/a:mysql:mysql:5.1.20 cpe:/a:mysql:mysql:5.1.2 cpe:/a:mysql:mysql:5.1.19 cpe:/a:mysql:mysql:5.1.18 cpe:/a:mysql:mysql:5.1.17 cpe:/a:mysql:mysql:5.1.16 cpe:/a:mysql:mysql:5.1.15 cpe:/a:mysql:mysql:5.1.14 cpe:/a:mysql:mysql:5.1.13 cpe:/a:mysql:mysql:5.1.12 cpe:/a:mysql:mysql:5.1.11 cpe:/a:mysql:mysql:5.1.10 cpe:/a:mysql:mysql:5.1.1 cpe:/a:mysql:mysql:5.1 cpe:/a:mysql:mysql:5.0.9 cpe:/a:mysql:mysql:5.0.83 cpe:/a:mysql:mysql:5.0.82 cpe:/a:mysql:mysql:5.0.81 cpe:/a:mysql:mysql:5.0.8 cpe:/a:mysql:mysql:5.0.77 cpe:/a:mysql:mysql:5.0.75 cpe:/a:mysql:mysql:5.0.7 cpe:/a:mysql:mysql:5.0.67 cpe:/a:mysql:mysql:5.0.66 cpe:/a:mysql:mysql:5.0.60 cpe:/a:mysql:mysql:5.0.6 cpe:/a:mysql:mysql:5.0.56 cpe:/a:mysql:mysql:5.0.54 cpe:/a:mysql:mysql:5.0.52 cpe:/a:mysql:mysql:5.0.51b cpe:/a:mysql:mysql:5.0.51a cpe:/a:mysql:mysql:5.0.51 cpe:/a:mysql:mysql:5.0.50 cpe:/a:mysql:mysql:5.0.5.0.21 cpe:/a:mysql:mysql:5.0.5 cpe:/a:mysql:mysql:5.0.4a cpe:/a:mysql:mysql:5.0.45 cpe:/a:mysql:mysql:5.0.44 cpe:/a:mysql:mysql:5.0.42 cpe:/a:mysql:mysql:5.0.41 cpe:/a:mysql:mysql:5.0.4 cpe:/a:mysql:mysql:5.0.3a cpe:/a:mysql:mysql:5.0.38 cpe:/a:mysql:mysql:5.0.37 cpe:/a:mysql:mysql:5.0.36 cpe:/a:mysql:mysql:5.0.33 cpe:/a:mysql:mysql:5.0.32 cpe:/a:mysql:mysql:5.0.30 cpe:/a:mysql:mysql:5.0.30:sp1 cpe:/a:mysql:mysql:5.0.3 cpe:/a:mysql:mysql:5.0.3:beta cpe:/a:mysql:mysql:5.0.27 cpe:/a:mysql:mysql:5.0.26 cpe:/a:mysql:mysql:5.0.25 cpe:/a:mysql:mysql:5.0.24a cpe:/a:mysql:mysql:5.0.24 cpe:/a:mysql:mysql:5.0.23 cpe:/a:mysql:mysql:5.0.22.1.0.1 cpe:/a:mysql:mysql:5.0.22 cpe:/a:mysql:mysql:5.0.21 cpe:/a:mysql:mysql:5.0.20a cpe:/a:mysql:mysql:5.0.20 cpe:/a:mysql:mysql:5.0.2 cpe:/a:mysql:mysql:5.0.1a cpe:/a:mysql:mysql:5.0.19 cpe:/a:mysql:mysql:5.0.18 cpe:/a:mysql:mysql:5.0.17a cpe:/a:mysql:mysql:5.0.17 cpe:/a:mysql:mysql:5.0.16a cpe:/a:mysql:mysql:5.0.16 cpe:/a:mysql:mysql:5.0.15a cpe:/a:mysql:mysql:5.0.15 cpe:/a:mysql:mysql:5.0.14 cpe:/a:mysql:mysql:5.0.13 cpe:/a:mysql:mysql:5.0.12 cpe:/a:mysql:mysql:5.0.11 cpe:/a:mysql:mysql:5.0.10a cpe:/a:mysql:mysql:5.0.10 cpe:/a:mysql:mysql:5.0.1 cpe:/a:mysql:mysql:5.0.0.0 cpe:/a:mysql:mysql:5.0.0:alpha cpe:/a:mysql:mysql:5.0.0 cpe:/a:mysql:mysql:5.0 cpe:/a:mysql:mysql:4.1.9 cpe:/a:mysql:mysql:4.1.8a cpe:/a:mysql:mysql:4.1.8 cpe:/a:mysql:mysql:4.1.7 cpe:/a:mysql:mysql:4.1.6 cpe:/a:mysql:mysql:4.1.5 cpe:/a:mysql:mysql:4.1.4 cpe:/a:mysql:mysql:4.1.3:beta cpe:/a:mysql:mysql:4.1.3 cpe:/a:mysql:mysql:4.1.23 cpe:/a:mysql:mysql:4.1.22 cpe:/a:mysql:mysql:4.1.21 cpe:/a:mysql:mysql:4.1.20 cpe:/a:mysql:mysql:4.1.2:alpha cpe:/a:mysql:mysql:4.1.2 cpe:/a:mysql:mysql:4.1.19 cpe:/a:mysql:mysql:4.1.18 cpe:/a:mysql:mysql:4.1.17 cpe:/a:mysql:mysql:4.1.16 cpe:/a:mysql:mysql:4.1.15a cpe:/a:mysql:mysql:4.1.15 cpe:/a:mysql:mysql:4.1.14a cpe:/a:mysql:mysql:4.1.14 cpe:/a:mysql:mysql:4.1.13a cpe:/a:mysql:mysql:4.1.13 cpe:/a:mysql:mysql:4.1.12a cpe:/a:mysql:mysql:4.1.12 cpe:/a:mysql:mysql:4.1.11 cpe:/a:mysql:mysql:4.1.10a cpe:/a:mysql:mysql:4.1.10 cpe:/a:mysql:mysql:4.1.1 cpe:/a:mysql:mysql:4.1.0.0 cpe:/a:mysql:mysql:4.1.0 cpe:/a:mysql:mysql:4.1.0:alpha cpe:/a:mysql:mysql:4.1 cpe:/a:mysql:mysql:4.0.9:gamma cpe:/a:mysql:mysql:4.0.9 cpe:/a:mysql:mysql:4.0.8 cpe:/a:mysql:mysql:4.0.8:gamma cpe:/a:mysql:mysql:4.0.7 cpe:/a:mysql:mysql:4.0.7:gamma cpe:/a:mysql:mysql:4.0.6 cpe:/a:mysql:mysql:4.0.5a cpe:/a:mysql:mysql:4.0.5 cpe:/a:mysql:mysql:4.0.4 cpe:/a:mysql:mysql:4.0.3 cpe:/a:mysql:mysql:4.0.27 cpe:/a:mysql:mysql:4.0.26 cpe:/a:mysql:mysql:4.0.25 cpe:/a:mysql:mysql:4.0.24 cpe:/a:mysql:mysql:4.0.23 cpe:/a:mysql:mysql:4.0.21 cpe:/a:mysql:mysql:4.0.20 cpe:/a:mysql:mysql:4.0.2 cpe:/a:mysql:mysql:4.0.19 cpe:/a:mysql:mysql:4.0.18 cpe:/a:mysql:mysql:4.0.17 cpe:/a:mysql:mysql:4.0.16 cpe:/a:mysql:mysql:4.0.15 cpe:/a:mysql:mysql:4.0.14 cpe:/a:mysql:mysql:4.0.13 cpe:/a:mysql:mysql:4.0.12 cpe:/a:mysql:mysql:4.0.11 cpe:/a:mysql:mysql:4.0.11:gamma cpe:/a:mysql:mysql:4.0.10 cpe:/a:mysql:mysql:4.0.1 cpe:/a:mysql:mysql:4.0.0 cpe:/a:mysql:mysql:3.23.9 cpe:/a:mysql:mysql:3.23.8 cpe:/a:mysql:mysql:3.23.7 cpe:/a:mysql:mysql:3.23.6 cpe:/a:mysql:mysql:3.23.59 cpe:/a:mysql:mysql:3.23.58 cpe:/a:mysql:mysql:3.23.57 cpe:/a:mysql:mysql:3.23.56 cpe:/a:mysql:mysql:3.23.55 cpe:/a:mysql:mysql:3.23.54a cpe:/a:mysql:mysql:3.23.54 cpe:/a:mysql:mysql:3.23.53a cpe:/a:mysql:mysql:3.23.53 cpe:/a:mysql:mysql:3.23.52 cpe:/a:mysql:mysql:3.23.51 cpe:/a:mysql:mysql:3.23.50 cpe:/a:mysql:mysql:3.23.5 cpe:/a:mysql:mysql:3.23.49 cpe:/a:mysql:mysql:3.23.48 cpe:/a:mysql:mysql:3.23.47 cpe:/a:mysql:mysql:3.23.46 cpe:/a:mysql:mysql:3.23.45 cpe:/a:mysql:mysql:3.23.44 cpe:/a:mysql:mysql:3.23.43 cpe:/a:mysql:mysql:3.23.42 cpe:/a:mysql:mysql:3.23.41 cpe:/a:mysql:mysql:3.23.40 cpe:/a:mysql:mysql:3.23.4 cpe:/a:mysql:mysql:3.23.39 cpe:/a:mysql:mysql:3.23.38 cpe:/a:mysql:mysql:3.23.37 cpe:/a:mysql:mysql:3.23.36 cpe:/a:mysql:mysql:3.23.35 cpe:/a:mysql:mysql:3.23.34 cpe:/a:mysql:mysql:3.23.33 cpe:/a:mysql:mysql:3.23.32 cpe:/a:mysql:mysql:3.23.31 cpe:/a:mysql:mysql:3.23.30 cpe:/a:mysql:mysql:3.23.3 cpe:/a:mysql:mysql:3.23.29 cpe:/a:mysql:mysql:3.23.28 cpe:/a:mysql:mysql:3.23.28:gamma cpe:/a:mysql:mysql:3.23.27 cpe:/a:mysql:mysql:3.23.26 cpe:/a:mysql:mysql:3.23.25 cpe:/a:mysql:mysql:3.23.24 cpe:/a:mysql:mysql:3.23.23 cpe:/a:mysql:mysql:3.23.22 cpe:/a:mysql:mysql:3.23.21 cpe:/a:mysql:mysql:3.23.20:beta cpe:/a:mysql:mysql:3.23.2 cpe:/a:mysql:mysql:3.23.19 cpe:/a:mysql:mysql:3.23.18 cpe:/a:mysql:mysql:3.23.17 cpe:/a:mysql:mysql:3.23.16 cpe:/a:mysql:mysql:3.23.15 cpe:/a:mysql:mysql:3.23.14 cpe:/a:mysql:mysql:3.23.13 cpe:/a:mysql:mysql:3.23.12 cpe:/a:mysql:mysql:3.23.11 cpe:/a:mysql:mysql:3.23.10 cpe:/a:mysql:mysql:3.23.1 cpe:/a:mysql:mysql:3.23.0:alpha cpe:/a:mysql:mysql:3.23 cpe:/a:mysql:mysql:3.22.32 cpe:/a:mysql:mysql:3.22.30 cpe:/a:mysql:mysql:3.22.29 cpe:/a:mysql:mysql:3.22.28 cpe:/a:mysql:mysql:3.22.27 cpe:/a:mysql:mysql:3.22.26 cpe:/a:mysql:mysql:3.22 cpe:/a:mysql:mysql:3.21 cpe:/a:mysql:mysql:3.20.32a cpe:/a:mysql:mysql:3.20 cpe:/a:mysql:mysql	243

Open Source Vulnerability Database (OSVDB)

id	Description
55734	MySQL sql_parse.cc dispatch_command() Function Format String DoS
48710	MySQL Command Line Client HTML Output XSS
48021	MySQL Empty Bit-String Literal Token SQL Statement DoS
44937	MySQL MyISAM Table CREATE TABLE Privilege Check Bypass