RHSA-2010:0824

Executive Summary

Summary
Title	mysql security update

Informations
Name	RHSA-2010:0824	First vendor Publication	2010-11-03
Vendor	RedHat	Last vendor Modification	2010-11-03
Severity (Vendor)	Moderate	Revision	01

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Cvss Base Score	6.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	8	Authentification	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated mysql packages that fix three security issues are now available for
Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

It was found that the MySQL PolyFromWKB() function did not sanity check
Well-Known Binary (WKB) data. A remote, authenticated attacker could use
specially-crafted WKB data to crash mysqld. This issue only caused a
temporary denial of service, as mysqld was automatically restarted after
the crash. (CVE-2010-3840)

A flaw was found in the way MySQL processed certain alternating READ
requests provided by HANDLER statements. A remote, authenticated attacker
could use this flaw to provide such requests, causing mysqld to crash. This
issue only caused a temporary denial of service, as mysqld was
automatically restarted after the crash. (CVE-2010-3681)

A directory traversal flaw was found in the way MySQL handled the
parameters of the MySQL COM_FIELD_LIST network protocol command. A remote,
authenticated attacker could use this flaw to obtain descriptions of the
fields of an arbitrary table using a request with a specially-crafted
table name. (CVE-2010-1848)

All MySQL users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. After installing this
update, the MySQL server daemon (mysqld) will be restarted automatically.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

592079 - CVE-2010-1848 mysql: multiple insufficient table name checks
628680 - CVE-2010-3681 MySQL: mysqld DoS (assertion failure) by alternate reads from two indexes on a table using the HANDLER interface (MySQL bug #54007)
640865 - CVE-2010-3840 MySQL: crash when loading data into geometry function PolyFromWKB() (MySQL Bug#51875)

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2010-0824.html

CWE : Common Weakness Enumeration

id	Name
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:7210

Oval ID:	oval:org.mitre.oval:def:7210
Title:	Oracle MySQL 'COM_FIELD_LIST' Command Packet Security Bypass Vulnerability
Description:	Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2010-1848	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008	Product(s):	MySQL Server 5.0 MySQL Server 5.1
Definition Synopsis:
IF MySQL 5.0 is installed AND MySQL Server 5.0 version is less than 5.0.91 OR MySQL 5.1 is installed AND MySQL Server 5.1 version is less than 5.1.47

Definition Id: oval:org.mitre.oval:def:10258

Oval ID:	oval:org.mitre.oval:def:10258
Title:	Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.
Description:	Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2010-1848	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section mysql is earlier than 0:5.0.77-4.el5_5.3 AND mysql-devel is earlier than 0:5.0.77-4.el5_5.3 AND mysql-test is earlier than 0:5.0.77-4.el5_5.3 AND mysql-bench is earlier than 0:5.0.77-4.el5_5.3 AND mysql-server is earlier than 0:5.0.77-4.el5_5.3

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mysql Mysql cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.1.9 cpe:/a:mysql:mysql:5.1.8 cpe:/a:mysql:mysql:5.1.7 cpe:/a:mysql:mysql:5.1.6 cpe:/a:mysql:mysql:5.1.5a cpe:/a:mysql:mysql:5.1.50 cpe:/a:mysql:mysql:5.1.5 cpe:/a:mysql:mysql:5.1.49:sp1 cpe:/a:mysql:mysql:5.1.49 cpe:/a:mysql:mysql:5.1.48 cpe:/a:mysql:mysql:5.1.47 cpe:/a:mysql:mysql:5.1.46:sp1 cpe:/a:mysql:mysql:5.1.46 cpe:/a:mysql:mysql:5.1.45 cpe:/a:mysql:mysql:5.1.44 cpe:/a:mysql:mysql:5.1.43:sp1 cpe:/a:mysql:mysql:5.1.43 cpe:/a:mysql:mysql:5.1.42 cpe:/a:mysql:mysql:5.1.41 cpe:/a:mysql:mysql:5.1.40:sp1 cpe:/a:mysql:mysql:5.1.40 cpe:/a:mysql:mysql:5.1.4 cpe:/a:mysql:mysql:5.1.39 cpe:/a:mysql:mysql:5.1.38 cpe:/a:mysql:mysql:5.1.37:sp1 cpe:/a:mysql:mysql:5.1.37 cpe:/a:mysql:mysql:5.1.36 cpe:/a:mysql:mysql:5.1.35 cpe:/a:mysql:mysql:5.1.34:sp1 cpe:/a:mysql:mysql:5.1.34 cpe:/a:mysql:mysql:5.1.33 cpe:/a:mysql:mysql:5.1.32-bzr cpe:/a:mysql:mysql:5.1.32 cpe:/a:mysql:mysql:5.1.31:sp1 cpe:/a:mysql:mysql:5.1.31 cpe:/a:mysql:mysql:5.1.30 cpe:/a:mysql:mysql:5.1.3 cpe:/a:mysql:mysql:5.1.29 cpe:/a:mysql:mysql:5.1.28 cpe:/a:mysql:mysql:5.1.27 cpe:/a:mysql:mysql:5.1.26 cpe:/a:mysql:mysql:5.1.25 cpe:/a:mysql:mysql:5.1.24 cpe:/a:mysql:mysql:5.1.23a cpe:/a:mysql:mysql:5.1.23_bk cpe:/a:mysql:mysql:5.1.23:a cpe:/a:mysql:mysql:5.1.23 cpe:/a:mysql:mysql:5.1.22 cpe:/a:mysql:mysql:5.1.21 cpe:/a:mysql:mysql:5.1.20 cpe:/a:mysql:mysql:5.1.2 cpe:/a:mysql:mysql:5.1.19 cpe:/a:mysql:mysql:5.1.18 cpe:/a:mysql:mysql:5.1.17 cpe:/a:mysql:mysql:5.1.16 cpe:/a:mysql:mysql:5.1.15 cpe:/a:mysql:mysql:5.1.14 cpe:/a:mysql:mysql:5.1.13 cpe:/a:mysql:mysql:5.1.12 cpe:/a:mysql:mysql:5.1.11 cpe:/a:mysql:mysql:5.1.10 cpe:/a:mysql:mysql:5.1.1 cpe:/a:mysql:mysql:5.1 cpe:/a:mysql:mysql:5.0.91 cpe:/a:mysql:mysql:5.0.90 cpe:/a:mysql:mysql:5.0.9 cpe:/a:mysql:mysql:5.0.89 cpe:/a:mysql:mysql:5.0.88 cpe:/a:mysql:mysql:5.0.87 cpe:/a:mysql:mysql:5.0.86 cpe:/a:mysql:mysql:5.0.85 cpe:/a:mysql:mysql:5.0.84 cpe:/a:mysql:mysql:5.0.83 cpe:/a:mysql:mysql:5.0.82 cpe:/a:mysql:mysql:5.0.81 cpe:/a:mysql:mysql:5.0.8 cpe:/a:mysql:mysql:5.0.77 cpe:/a:mysql:mysql:5.0.75 cpe:/a:mysql:mysql:5.0.7 cpe:/a:mysql:mysql:5.0.67 cpe:/a:mysql:mysql:5.0.6 cpe:/a:mysql:mysql:5.0.51b cpe:/a:mysql:mysql:5.0.51a cpe:/a:mysql:mysql:5.0.5.0.21 cpe:/a:mysql:mysql:5.0.5 cpe:/a:mysql:mysql:5.0.4a cpe:/a:mysql:mysql:5.0.45b cpe:/a:mysql:mysql:5.0.45 cpe:/a:mysql:mysql:5.0.41 cpe:/a:mysql:mysql:5.0.4 cpe:/a:mysql:mysql:5.0.3a cpe:/a:mysql:mysql:5.0.37 cpe:/a:mysql:mysql:5.0.33 cpe:/a:mysql:mysql:5.0.3 cpe:/a:mysql:mysql:5.0.3:beta cpe:/a:mysql:mysql:5.0.27 cpe:/a:mysql:mysql:5.0.24a cpe:/a:mysql:mysql:5.0.24 cpe:/a:mysql:mysql:5.0.23 cpe:/a:mysql:mysql:5.0.22 cpe:/a:mysql:mysql:5.0.21 cpe:/a:mysql:mysql:5.0.20a cpe:/a:mysql:mysql:5.0.20 cpe:/a:mysql:mysql:5.0.2 cpe:/a:mysql:mysql:5.0.1a cpe:/a:mysql:mysql:5.0.19 cpe:/a:mysql:mysql:5.0.18 cpe:/a:mysql:mysql:5.0.17a cpe:/a:mysql:mysql:5.0.17 cpe:/a:mysql:mysql:5.0.16a cpe:/a:mysql:mysql:5.0.16 cpe:/a:mysql:mysql:5.0.15a cpe:/a:mysql:mysql:5.0.15 cpe:/a:mysql:mysql:5.0.14 cpe:/a:mysql:mysql:5.0.13 cpe:/a:mysql:mysql:5.0.12 cpe:/a:mysql:mysql:5.0.11 cpe:/a:mysql:mysql:5.0.10a cpe:/a:mysql:mysql:5.0.10 cpe:/a:mysql:mysql:5.0.1 cpe:/a:mysql:mysql:5.0.0.0 cpe:/a:mysql:mysql:5.0.0:alpha cpe:/a:mysql:mysql:5.0.0 cpe:/a:mysql:mysql:5.0	129

Open Source Vulnerability Database (OSVDB)

id	Description
69001	MySQL PolyFromWKB() Function WKB Data Remote DoS
69000	MySQL HANDLER Interface Unspecified READ Request DoS
64586	MySQL COM_FIELD_LIST Command Packet Authentication Bypass