Executive Summary
Summary | |
---|---|
Title | mysql security update |
Informations | |||
---|---|---|---|
Name | RHSA-2010:0109 | First vendor Publication | 2010-02-16 |
Vendor | RedHat | Last vendor Modification | 2010-02-16 |
Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. It was discovered that the MySQL client ignored certain SSL certificate verification errors when connecting to servers. A man-in-the-middle attacker could use this flaw to trick MySQL clients into connecting to a spoofed MySQL server. (CVE-2009-4028) Note: This fix may uncover previously hidden SSL configuration issues, such as incorrect CA certificates being used by clients or expired server certificates. This update should be carefully tested in deployments where SSL connections are used. A flaw was found in the way MySQL handled SELECT statements with subqueries in the WHERE clause, that assigned results to a user variable. A remote, authenticated attacker could use this flaw to crash the MySQL server daemon (mysqld). This issue only caused a temporary denial of service, as the MySQL daemon was automatically restarted after the crash. (CVE-2009-4019) When the "datadir" option was configured with a relative path, MySQL did not properly check paths used as arguments for the DATA DIRECTORY and INDEX DIRECTORY directives. An authenticated attacker could use this flaw to bypass the restriction preventing the use of subdirectories of the MySQL data directory being used as DATA DIRECTORY and INDEX DIRECTORY paths. (CVE-2009-4030) Note: Due to the security risks and previous security issues related to the use of the DATA DIRECTORY and INDEX DIRECTORY directives, users not depending on this feature should consider disabling it by adding "symbolic-links=0" to the "[mysqld]" section of the "my.cnf" configuration file. In this update, an example of such a configuration was added to the default "my.cnf" file. All MySQL users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 540906 - CVE-2009-4019 mysql: DoS (crash) when comparing GIS items from subquery and when handling subqueires in WHERE and assigning a SELECT result to a @variable 541233 - CVE-2009-4028 mysql: client SSL certificate verification flaw 543653 - CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098 |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2010-0109.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
25 % | CWE-264 | Permissions, Privileges, and Access Controls |
25 % | CWE-20 | Improper Input Validation |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10133 | |||
Oval ID: | oval:org.mitre.oval:def:10133 | ||
Title: | MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future. | ||
Description: | MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2008-2079 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:10591 | |||
Oval ID: | oval:org.mitre.oval:def:10591 | ||
Title: | MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097. | ||
Description: | MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2008-4098 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:10940 | |||
Oval ID: | oval:org.mitre.oval:def:10940 | ||
Title: | The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library. | ||
Description: | The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-4028 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:11116 | |||
Oval ID: | oval:org.mitre.oval:def:11116 | ||
Title: | MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079. | ||
Description: | MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-4030 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:11349 | |||
Oval ID: | oval:org.mitre.oval:def:11349 | ||
Title: | mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement. | ||
Description: | mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-4019 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:18619 | |||
Oval ID: | oval:org.mitre.oval:def:18619 | ||
Title: | DSA-1608-1 mysql-dfsg-5.0 - authorisation bypass | ||
Description: | Sergei Golubchik discovered that MySQL, a widely-deployed database server, did not properly validate optional data or index directory paths given in a CREATE TABLE statement, nor would it (under proper conditions) prevent two databases from using the same paths for data or index files. This permits an authenticated user with authorisation to create tables in one database to read, write or delete data from tables subsequently created in other databases, regardless of other GRANT authorisations. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1608-1 CVE-2008-2079 | Version: | 7 |
Platform(s): | Debian GNU/Linux 4.0 | Product(s): | mysql-dfsg-5.0 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:21419 | |||
Oval ID: | oval:org.mitre.oval:def:21419 | ||
Title: | RHSA-2010:0109: mysql security update (Moderate) | ||
Description: | MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2010:0109-01 CESA-2010:0109 CVE-2009-4019 CVE-2009-4028 CVE-2009-4030 | Version: | 42 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | mysql |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22758 | |||
Oval ID: | oval:org.mitre.oval:def:22758 | ||
Title: | ELSA-2010:0109: mysql security update (Moderate) | ||
Description: | MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2010:0109-01 CVE-2009-4019 CVE-2009-4028 CVE-2009-4030 | Version: | 17 |
Platform(s): | Oracle Linux 5 | Product(s): | mysql |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:28260 | |||
Oval ID: | oval:org.mitre.oval:def:28260 | ||
Title: | DEPRECATED: ELSA-2010-0109 -- mysql security update (moderate) | ||
Description: | [5.0.77-4.2] - Add fixes for CVE-2009-4019, CVE-2009-4028, CVE-2009-4030 Resolves: #556505 - Use non-expired certificates for SSL testing (upstream bug 50702) - Emit explicit error message if user tries to build RPM as root - Add comment suggesting disabling symbolic links in /etc/my.cnf | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2010-0109 CVE-2009-4019 CVE-2009-4028 CVE-2009-4030 | Version: | 4 |
Platform(s): | Oracle Linux 5 | Product(s): | mysql |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7917 | |||
Oval ID: | oval:org.mitre.oval:def:7917 | ||
Title: | DSA-1608 mysql-dfsg-5.0 -- authorisation bypass | ||
Description: | Sergei Golubchik discovered that MySQL, a widely-deployed database server, did not properly validate optional data or index directory paths given in a CREATE TABLE statement, nor would it (under proper conditions) prevent two databases from using the same paths for data or index files. This permits an authenticated user with authorisation to create tables in one database to read, write or delete data from tables subsequently created in other databases, regardless of other GRANT authorisations. The Common Vulnerabilities and Exposures project identifies this weakness as CVE-2008-2079. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1608 CVE-2008-2079 | Version: | 3 |
Platform(s): | Debian GNU/Linux 4.0 | Product(s): | mysql-dfsg-5.0 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:8156 | |||
Oval ID: | oval:org.mitre.oval:def:8156 | ||
Title: | MySQL 5.1 Privilege Bypass with DATA/INDEX DIRECTORY | ||
Description: | MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2009-4030 | Version: | 3 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 | Product(s): | MySQL Server 5.1 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:8500 | |||
Oval ID: | oval:org.mitre.oval:def:8500 | ||
Title: | MySQL 5.0 and 5.1 SELECT Statement DOS Vulnerability | ||
Description: | mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2009-4019 | Version: | 3 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 | Product(s): | MySQL Server 5.0 MySQL Server 5.1 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:8510 | |||
Oval ID: | oval:org.mitre.oval:def:8510 | ||
Title: | MySQL 5.0 and 5.1 Clients with OpenSSL Vulnerability Allows Bypassing Server Certificate Checking | ||
Description: | The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2009-4028 | Version: | 3 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 | Product(s): | MySQL Server 5.0 MySQL Server 5.1 |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-03-16 | Name : Ubuntu Update for mysql-5.1 USN-1397-1 File : nvt/gb_ubuntu_USN_1397_1.nasl |
2012-02-12 | Name : Gentoo Security Advisory GLSA 201201-02 (MySQL) File : nvt/glsa_201201_02.nasl |
2011-08-09 | Name : CentOS Update for mysql CESA-2009:1289 centos5 i386 File : nvt/gb_CESA-2009_1289_mysql_centos5_i386.nasl |
2011-08-09 | Name : CentOS Update for mysql CESA-2010:0109 centos5 i386 File : nvt/gb_CESA-2010_0109_mysql_centos5_i386.nasl |
2010-08-06 | Name : Fedora Update for mysql FEDORA-2010-11126 File : nvt/gb_fedora_2010_11126_mysql_fc12.nasl |
2010-06-11 | Name : Fedora Update for mysql FEDORA-2010-9061 File : nvt/gb_fedora_2010_9061_mysql_fc11.nasl |
2010-06-11 | Name : Fedora Update for mysql FEDORA-2010-9053 File : nvt/gb_fedora_2010_9053_mysql_fc12.nasl |
2010-05-17 | Name : Fedora Update for mysql FEDORA-2010-7414 File : nvt/gb_fedora_2010_7414_mysql_fc12.nasl |
2010-05-17 | Name : Fedora Update for mysql FEDORA-2010-7355 File : nvt/gb_fedora_2010_7355_mysql_fc11.nasl |
2010-05-12 | Name : Mac OS X Security Update 2008-007 File : nvt/macosx_secupd_2008-007.nasl |
2010-05-12 | Name : Mac OS X Security Update 2009-005 File : nvt/macosx_secupd_2009-005.nasl |
2010-05-12 | Name : Mac OS X 10.6.3 Update / Mac OS X Security Update 2010-002 File : nvt/macosx_upd_10_6_3_secupd_2010-002.nasl |
2010-03-02 | Name : Fedora Update for mysql FEDORA-2010-1300 File : nvt/gb_fedora_2010_1300_mysql_fc11.nasl |
2010-03-02 | Name : Fedora Update for mysql FEDORA-2010-1348 File : nvt/gb_fedora_2010_1348_mysql_fc12.nasl |
2010-02-19 | Name : RedHat Update for mysql RHSA-2010:0109-01 File : nvt/gb_RHSA-2010_0109-01_mysql.nasl |
2010-02-19 | Name : CentOS Update for mysql CESA-2010:0110 centos4 i386 File : nvt/gb_CESA-2010_0110_mysql_centos4_i386.nasl |
2010-02-19 | Name : RedHat Update for mysql RHSA-2010:0110-01 File : nvt/gb_RHSA-2010_0110-01_mysql.nasl |
2010-02-15 | Name : Ubuntu Update for MySQL vulnerabilities USN-897-1 File : nvt/gb_ubuntu_USN_897_1.nasl |
2010-01-19 | Name : Mandriva Update for mysql MDVSA-2010:012 (mysql) File : nvt/gb_mandriva_MDVSA_2010_012.nasl |
2010-01-19 | Name : Mandriva Update for mysql MDVSA-2010:011 (mysql) File : nvt/gb_mandriva_MDVSA_2010_011.nasl |
2009-12-30 | Name : Fedora Core 12 FEDORA-2009-13466 (mysql) File : nvt/fcore_2009_13466.nasl |
2009-12-30 | Name : Fedora Core 11 FEDORA-2009-13504 (mysql) File : nvt/fcore_2009_13504.nasl |
2009-12-14 | Name : Fedora Core 10 FEDORA-2009-12180 (mysql) File : nvt/fcore_2009_12180.nasl |
2009-12-10 | Name : Mandriva Security Advisory MDVSA-2009:326 (mysql) File : nvt/mdksa_2009_326.nasl |
2009-12-04 | Name : MySQL Authenticated Access Restrictions Bypass Vulnerability File : nvt/gb_mysql_auth_bypass_vuln.nasl |
2009-12-04 | Name : MySQL Denial Of Service and Spoofing Vulnerabilities File : nvt/gb_mysql_dos_n_spoofing_vuln.nasl |
2009-11-20 | Name : MySQL multiple Vulnerabilities File : nvt/mysql_multiple_vuln.nasl |
2009-10-13 | Name : SLES10: Security update for MySQL File : nvt/sles10_mysql0.nasl |
2009-10-13 | Name : SLES10: Security update for MySQL File : nvt/sles10_mysql1.nasl |
2009-10-10 | Name : SLES9: Security update for MySQL File : nvt/sles9p5032620.nasl |
2009-10-10 | Name : SLES9: Security update for MySQL File : nvt/sles9p5040120.nasl |
2009-09-21 | Name : CentOS Security Advisory CESA-2009:1289 (mysql) File : nvt/ovcesa2009_1289.nasl |
2009-09-09 | Name : RedHat Security Advisory RHSA-2009:1289 File : nvt/RHSA_2009_1289.nasl |
2009-06-05 | Name : Ubuntu USN-763-1 (xine-lib) File : nvt/ubuntu_763_1.nasl |
2009-06-05 | Name : RedHat Security Advisory RHSA-2009:1067 File : nvt/RHSA_2009_1067.nasl |
2009-04-28 | Name : Mandrake Security Advisory MDVSA-2009:094 (mysql) File : nvt/mdksa_2009_094.nasl |
2009-04-23 | Name : MySQL MyISAM Table Privileges Secuity Bypass Vulnerability File : nvt/mysql_29106.nasl |
2009-04-09 | Name : Mandriva Update for mysql MDVSA-2008:150 (mysql) File : nvt/gb_mandriva_MDVSA_2008_150.nasl |
2009-04-09 | Name : Mandriva Update for mysql MDVSA-2008:149 (mysql) File : nvt/gb_mandriva_MDVSA_2008_149.nasl |
2009-03-23 | Name : Ubuntu Update for mysql-dfsg-5.0 vulnerabilities USN-671-1 File : nvt/gb_ubuntu_USN_671_1.nasl |
2009-03-06 | Name : RedHat Update for mysql RHSA-2008:0768-01 File : nvt/gb_RHSA-2008_0768-01_mysql.nasl |
2009-01-23 | Name : SuSE Update for openwsman SUSE-SA:2008:041 File : nvt/gb_suse_2008_041.nasl |
2009-01-20 | Name : SuSE Security Summary SUSE-SR:2009:001 (OpenSuSE 11.1) File : nvt/suse_sr_2009_001.nasl |
2009-01-20 | Name : SuSE Security Summary SUSE-SR:2009:001 (OpenSuSE 11.0) File : nvt/suse_sr_2009_001a.nasl |
2009-01-20 | Name : SuSE Security Summary SUSE-SR:2009:001 (OpenSuSE 10.3) File : nvt/suse_sr_2009_001b.nasl |
2009-01-02 | Name : FreeBSD Ports: mysql-server File : nvt/freebsd_mysql-server15.nasl |
2008-11-19 | Name : Debian Security Advisory DSA 1662-1 (mysql-dfsg-5.0) File : nvt/deb_1662_1.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200809-04 (mysql) File : nvt/glsa_200809_04.nasl |
2008-09-17 | Name : FreeBSD Ports: mysql-server File : nvt/freebsd_mysql-server14.nasl |
2008-07-15 | Name : Debian Security Advisory DSA 1608-1 (mysql-dfsg-5.0) File : nvt/deb_1608_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
60665 | MySQL CREATE TABLE MyISAM Table mysql_unpacked_real_data_home Local Restricti... |
60489 | MySQL GeomFromWKB() Function First Argument Geometry Value Handling DoS |
60488 | MySQL SELECT Statement WHERE Clause Sub-query DoS |
60487 | MySQL vio_verify_callback() Function Crafted Certificate MiTM Weakness |
44937 | MySQL MyISAM Table CREATE TABLE Privilege Check Bypass |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | Database SELECT subquery denial of service attempt RuleID : 20053 - Revision : 7 - Type : SERVER-MYSQL |
2014-01-10 | database Procedure Analyse denial of service attempt - 2 RuleID : 16349 - Revision : 7 - Type : SERVER-MYSQL |
2014-01-10 | database PROCEDURE ANALYSE denial of service attempt - 1 RuleID : 16348 - Revision : 7 - Type : SERVER-MYSQL |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_mysql_20130924.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0121.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0110.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0109.nasl - Type : ACT_GATHER_INFO |
2013-01-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1289.nasl - Type : ACT_GATHER_INFO |
2013-01-17 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0121.nasl - Type : ACT_GATHER_INFO |
2013-01-17 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130108_mysql_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2013-01-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0121.nasl - Type : ACT_GATHER_INFO |
2012-11-15 | Name : The remote database server is affected by a local user to bypass privilege ce... File : mysql_5_0_95_create_table_bypass.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080724_mysql_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090902_mysql_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100216_mysql_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100216_mysql_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2012-03-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1397-1.nasl - Type : ACT_GATHER_INFO |
2012-01-16 | Name : The remote database server allows a local user to circumvent privileges. File : mysql_6_0_14_priv_bypass.nasl - Type : ACT_GATHER_INFO |
2012-01-06 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201201-02.nasl - Type : ACT_GATHER_INFO |
2010-12-02 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libmysqlclient-devel-100429.nasl - Type : ACT_GATHER_INFO |
2010-11-09 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12661.nasl - Type : ACT_GATHER_INFO |
2010-10-11 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mysql-6899.nasl - Type : ACT_GATHER_INFO |
2010-07-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-012.nasl - Type : ACT_GATHER_INFO |
2010-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_libmysqlclient-devel-100504.nasl - Type : ACT_GATHER_INFO |
2010-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_libmysqlclient-devel-100401.nasl - Type : ACT_GATHER_INFO |
2010-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_libmysqlclient-devel-100401.nasl - Type : ACT_GATHER_INFO |
2010-05-04 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_libmysqlclient-devel-091216.nasl - Type : ACT_GATHER_INFO |
2010-05-04 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_libmysqlclient-devel-091216.nasl - Type : ACT_GATHER_INFO |
2010-05-04 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_libmysqlclient-devel-091215.nasl - Type : ACT_GATHER_INFO |
2010-03-29 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_6_3.nasl - Type : ACT_GATHER_INFO |
2010-03-19 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mysql-6897.nasl - Type : ACT_GATHER_INFO |
2010-03-02 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0109.nasl - Type : ACT_GATHER_INFO |
2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1997.nasl - Type : ACT_GATHER_INFO |
2010-02-18 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0110.nasl - Type : ACT_GATHER_INFO |
2010-02-17 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0109.nasl - Type : ACT_GATHER_INFO |
2010-02-17 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0110.nasl - Type : ACT_GATHER_INFO |
2010-02-11 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-897-1.nasl - Type : ACT_GATHER_INFO |
2010-01-18 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-011.nasl - Type : ACT_GATHER_INFO |
2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1289.nasl - Type : ACT_GATHER_INFO |
2009-12-22 | Name : The remote Fedora host is missing a security update. File : fedora_2009-13466.nasl - Type : ACT_GATHER_INFO |
2009-12-22 | Name : The remote Fedora host is missing a security update. File : fedora_2009-13504.nasl - Type : ACT_GATHER_INFO |
2009-12-14 | Name : The remote Fedora host is missing a security update. File : fedora_2009-12180.nasl - Type : ACT_GATHER_INFO |
2009-12-08 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-326.nasl - Type : ACT_GATHER_INFO |
2009-11-25 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_1_41.nasl - Type : ACT_GATHER_INFO |
2009-11-25 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_0_88.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12175.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12256.nasl - Type : ACT_GATHER_INFO |
2009-09-11 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2009-005.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_libmysqlclient-devel-080919.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-149.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-150.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-094.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-671-1.nasl - Type : ACT_GATHER_INFO |
2008-12-30 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_738f8f9ed66111dda7650030843d3802.nasl - Type : ACT_GATHER_INFO |
2008-12-21 | Name : The remote openSUSE host is missing a security update. File : suse_libmysqlclient-devel-5619.nasl - Type : ACT_GATHER_INFO |
2008-12-01 | Name : The remote openSUSE host is missing a security update. File : suse_mysql-5613.nasl - Type : ACT_GATHER_INFO |
2008-11-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mysql-5618.nasl - Type : ACT_GATHER_INFO |
2008-11-09 | Name : The remote database server is susceptible to a privilege bypass attack. File : mysql_es_5_0_70.nasl - Type : ACT_GATHER_INFO |
2008-11-06 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1662.nasl - Type : ACT_GATHER_INFO |
2008-10-10 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-007.nasl - Type : ACT_GATHER_INFO |
2008-09-11 | Name : The remote database server is affected by several issues. File : mysql_5_0_67.nasl - Type : ACT_GATHER_INFO |
2008-09-10 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_388d9ee47f2211dda66a0019666436c2.nasl - Type : ACT_GATHER_INFO |
2008-09-05 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200809-04.nasl - Type : ACT_GATHER_INFO |
2008-08-14 | Name : The remote openSUSE host is missing a security update. File : suse_libmysqlclient-devel-5341.nasl - Type : ACT_GATHER_INFO |
2008-08-14 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mysql-5338.nasl - Type : ACT_GATHER_INFO |
2008-07-25 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0768.nasl - Type : ACT_GATHER_INFO |
2008-07-15 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1608.nasl - Type : ACT_GATHER_INFO |
2008-05-09 | Name : The remote database server allows a local user to circumvent privileges. File : mysql_4_1_24.nasl - Type : ACT_GATHER_INFO |
2008-05-09 | Name : The remote database server allows a local user to circumvent privileges. File : mysql_es_5_0_60.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:53:15 |
|
2013-01-23 13:23:21 |
|