RHSA-2012:0105

Executive Summary

Summary
Title	mysql security update

Informations
Name	RHSA-2012:0105	First vendor Publication	2012-02-08
Vendor	RedHat	Last vendor Modification	2012-02-08
Severity (Vendor)	Important	Revision	01

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:N/A:P)
Cvss Base Score	5.5	Attack Range	Network
Cvss Impact Score	4.9	Attack Complexity	Low
Cvss Expoit Score	8	Authentification	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated mysql packages that fix several security issues are now available
for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

This update fixes several vulnerabilities in the MySQL database server.
Information about these flaws can be found on the Oracle Critical Patch
Update Advisory page, listed in the References section. (CVE-2011-2262,
CVE-2012-0075, CVE-2012-0087, CVE-2012-0101, CVE-2012-0102, CVE-2012-0112,
CVE-2012-0113, CVE-2012-0114, CVE-2012-0115, CVE-2012-0116, CVE-2012-0118,
CVE-2012-0119, CVE-2012-0120, CVE-2012-0484, CVE-2012-0485, CVE-2012-0490,
CVE-2012-0492)

These updated packages upgrade MySQL to version 5.1.61. Refer to the MySQL
release notes for a full list of changes:

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html

All MySQL users should upgrade to these updated packages, which correct
these issues. After installing this update, the MySQL server daemon
(mysqld) will be restarted automatically.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

783793 - CVE-2011-2262 mysql: Unspecified vulnerability allows remote attackers to affect availability
783794 - CVE-2012-0075 mysql: Unspecified vulnerability allows remote authenticated users to affect integrity
783795 - CVE-2012-0087 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783797 - CVE-2012-0101 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783798 - CVE-2012-0102 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783799 - CVE-2012-0112 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783800 - CVE-2012-0113 mysql: Unspecified vulnerability allows remote authenticated users to affect confidentiality and availability
783801 - CVE-2012-0114 mysql: Unspecified vulnerability allows local users to affect confidentiality and integrity
783802 - CVE-2012-0115 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783803 - CVE-2012-0116 mysql: Unspecified vulnerability allows remote authenticated users to affect confidentiality and integrity
783805 - CVE-2012-0118 mysql: Unspecified vulnerability allows remote authenticated users to affect confidentiality and availability
783806 - CVE-2012-0119 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783807 - CVE-2012-0120 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783808 - CVE-2012-0484 mysql: Unspecified vulnerability allows remote authenticated users to affect confidentiality
783809 - CVE-2012-0485 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783815 - CVE-2012-0490 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783817 - CVE-2012-0492 mysql: Unspecified vulnerability allows remote authenticated users to affect availability

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2012-0105.html

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mysql Mysql cpe:/a:mysql:mysql:5.5.9 cpe:/a:mysql:mysql:5.5.8 cpe:/a:mysql:mysql:5.5.7 cpe:/a:mysql:mysql:5.5.6 cpe:/a:mysql:mysql:5.5.5 cpe:/a:mysql:mysql:5.5.4 cpe:/a:mysql:mysql:5.5.3 cpe:/a:mysql:mysql:5.5.2 cpe:/a:mysql:mysql:5.5.1 cpe:/a:mysql:mysql:5.5.0 cpe:/a:mysql:mysql:5.1.9 cpe:/a:mysql:mysql:5.1.8 cpe:/a:mysql:mysql:5.1.7 cpe:/a:mysql:mysql:5.1.6 cpe:/a:mysql:mysql:5.1.5a cpe:/a:mysql:mysql:5.1.50 cpe:/a:mysql:mysql:5.1.5 cpe:/a:mysql:mysql:5.1.49:sp1 cpe:/a:mysql:mysql:5.1.49 cpe:/a:mysql:mysql:5.1.48 cpe:/a:mysql:mysql:5.1.47 cpe:/a:mysql:mysql:5.1.46 cpe:/a:mysql:mysql:5.1.46:sp1 cpe:/a:mysql:mysql:5.1.45 cpe:/a:mysql:mysql:5.1.44 cpe:/a:mysql:mysql:5.1.43 cpe:/a:mysql:mysql:5.1.43:sp1 cpe:/a:mysql:mysql:5.1.42 cpe:/a:mysql:mysql:5.1.41 cpe:/a:mysql:mysql:5.1.40 cpe:/a:mysql:mysql:5.1.40:sp1 cpe:/a:mysql:mysql:5.1.4 cpe:/a:mysql:mysql:5.1.39 cpe:/a:mysql:mysql:5.1.38 cpe:/a:mysql:mysql:5.1.37:sp1 cpe:/a:mysql:mysql:5.1.37 cpe:/a:mysql:mysql:5.1.36 cpe:/a:mysql:mysql:5.1.35 cpe:/a:mysql:mysql:5.1.34:sp1 cpe:/a:mysql:mysql:5.1.34 cpe:/a:mysql:mysql:5.1.33 cpe:/a:mysql:mysql:5.1.32-bzr cpe:/a:mysql:mysql:5.1.32 cpe:/a:mysql:mysql:5.1.31 cpe:/a:mysql:mysql:5.1.31:sp1 cpe:/a:mysql:mysql:5.1.30 cpe:/a:mysql:mysql:5.1.3 cpe:/a:mysql:mysql:5.1.29 cpe:/a:mysql:mysql:5.1.28 cpe:/a:mysql:mysql:5.1.27 cpe:/a:mysql:mysql:5.1.26 cpe:/a:mysql:mysql:5.1.25 cpe:/a:mysql:mysql:5.1.24 cpe:/a:mysql:mysql:5.1.23a cpe:/a:mysql:mysql:5.1.23_bk cpe:/a:mysql:mysql:5.1.23 cpe:/a:mysql:mysql:5.1.23:a cpe:/a:mysql:mysql:5.1.22 cpe:/a:mysql:mysql:5.1.21 cpe:/a:mysql:mysql:5.1.20 cpe:/a:mysql:mysql:5.1.2 cpe:/a:mysql:mysql:5.1.19 cpe:/a:mysql:mysql:5.1.18 cpe:/a:mysql:mysql:5.1.17 cpe:/a:mysql:mysql:5.1.16 cpe:/a:mysql:mysql:5.1.15 cpe:/a:mysql:mysql:5.1.14 cpe:/a:mysql:mysql:5.1.13 cpe:/a:mysql:mysql:5.1.12 cpe:/a:mysql:mysql:5.1.11 cpe:/a:mysql:mysql:5.1.10 cpe:/a:mysql:mysql:5.1.1 cpe:/a:mysql:mysql:5.1 cpe:/a:mysql:mysql:5.0.94 cpe:/a:mysql:mysql:5.0.93 cpe:/a:mysql:mysql:5.0.92 cpe:/a:mysql:mysql:5.0.91 cpe:/a:mysql:mysql:5.0.90 cpe:/a:mysql:mysql:5.0.9 cpe:/a:mysql:mysql:5.0.89 cpe:/a:mysql:mysql:5.0.88 cpe:/a:mysql:mysql:5.0.87 cpe:/a:mysql:mysql:5.0.86 cpe:/a:mysql:mysql:5.0.85 cpe:/a:mysql:mysql:5.0.84 cpe:/a:mysql:mysql:5.0.83 cpe:/a:mysql:mysql:5.0.82 cpe:/a:mysql:mysql:5.0.81 cpe:/a:mysql:mysql:5.0.8 cpe:/a:mysql:mysql:5.0.77 cpe:/a:mysql:mysql:5.0.75 cpe:/a:mysql:mysql:5.0.7 cpe:/a:mysql:mysql:5.0.67 cpe:/a:mysql:mysql:5.0.66 cpe:/a:mysql:mysql:5.0.60 cpe:/a:mysql:mysql:5.0.6 cpe:/a:mysql:mysql:5.0.56 cpe:/a:mysql:mysql:5.0.54 cpe:/a:mysql:mysql:5.0.52 cpe:/a:mysql:mysql:5.0.51b cpe:/a:mysql:mysql:5.0.51a cpe:/a:mysql:mysql:5.0.51 cpe:/a:mysql:mysql:5.0.50 cpe:/a:mysql:mysql:5.0.5.0.21 cpe:/a:mysql:mysql:5.0.5 cpe:/a:mysql:mysql:5.0.4a cpe:/a:mysql:mysql:5.0.45b cpe:/a:mysql:mysql:5.0.45:b cpe:/a:mysql:mysql:5.0.45 cpe:/a:mysql:mysql:5.0.44 cpe:/a:mysql:mysql:5.0.42 cpe:/a:mysql:mysql:5.0.41 cpe:/a:mysql:mysql:5.0.4 cpe:/a:mysql:mysql:5.0.3a cpe:/a:mysql:mysql:5.0.38 cpe:/a:mysql:mysql:5.0.37 cpe:/a:mysql:mysql:5.0.36 cpe:/a:mysql:mysql:5.0.33 cpe:/a:mysql:mysql:5.0.32 cpe:/a:mysql:mysql:5.0.30 cpe:/a:mysql:mysql:5.0.30:sp1 cpe:/a:mysql:mysql:5.0.3 cpe:/a:mysql:mysql:5.0.3:beta cpe:/a:mysql:mysql:5.0.27 cpe:/a:mysql:mysql:5.0.26 cpe:/a:mysql:mysql:5.0.25 cpe:/a:mysql:mysql:5.0.24a cpe:/a:mysql:mysql:5.0.24 cpe:/a:mysql:mysql:5.0.23 cpe:/a:mysql:mysql:5.0.22.1.0.1 cpe:/a:mysql:mysql:5.0.22 cpe:/a:mysql:mysql:5.0.21 cpe:/a:mysql:mysql:5.0.20a cpe:/a:mysql:mysql:5.0.20 cpe:/a:mysql:mysql:5.0.2 cpe:/a:mysql:mysql:5.0.1a cpe:/a:mysql:mysql:5.0.19 cpe:/a:mysql:mysql:5.0.18 cpe:/a:mysql:mysql:5.0.17a cpe:/a:mysql:mysql:5.0.17 cpe:/a:mysql:mysql:5.0.16a cpe:/a:mysql:mysql:5.0.16 cpe:/a:mysql:mysql:5.0.15a cpe:/a:mysql:mysql:5.0.15 cpe:/a:mysql:mysql:5.0.14 cpe:/a:mysql:mysql:5.0.13 cpe:/a:mysql:mysql:5.0.12 cpe:/a:mysql:mysql:5.0.11 cpe:/a:mysql:mysql:5.0.10a cpe:/a:mysql:mysql:5.0.10 cpe:/a:mysql:mysql:5.0.1 cpe:/a:mysql:mysql:5.0.0.0 cpe:/a:mysql:mysql:5.0.0:alpha cpe:/a:mysql:mysql:5.0.0 cpe:/a:mysql:mysql:5.0	155
Application	Oracle Mysql cpe:/a:oracle:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.8 cpe:/a:oracle:mysql:5.5.7 cpe:/a:oracle:mysql:5.5.6 cpe:/a:oracle:mysql:5.5.5 cpe:/a:oracle:mysql:5.5.4 cpe:/a:oracle:mysql:5.5.3 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.2 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.1 cpe:/a:oracle:mysql:5.1.65 cpe:/a:oracle:mysql:5.1.64 cpe:/a:oracle:mysql:5.1.63 cpe:/a:oracle:mysql:5.1.62 cpe:/a:oracle:mysql:5.1.61 cpe:/a:oracle:mysql:5.1.60 cpe:/a:oracle:mysql:5.1.59 cpe:/a:oracle:mysql:5.1.58 cpe:/a:oracle:mysql:5.1.57 cpe:/a:oracle:mysql:5.1.56 cpe:/a:oracle:mysql:5.1.55 cpe:/a:oracle:mysql:5.1.54 cpe:/a:oracle:mysql:5.1.53 cpe:/a:oracle:mysql:5.1.52:sp1 cpe:/a:oracle:mysql:5.1.52 cpe:/a:oracle:mysql:5.1.51	45

Open Source Vulnerability Database (OSVDB)

id	Description
78393	Oracle MySQL Server Unspecified Remote DoS (2012-0492)
78391	Oracle MySQL Server Unspecified Remote DoS (2012-0112)
78388	Oracle MySQL Server Unspecified Remote DoS (2012-0490)
78383	Oracle MySQL Server Unspecified Remote DoS (2012-0485)
78382	Oracle MySQL Server Unspecified Remote DoS (2012-0120)
78381	Oracle MySQL Server Unspecified Remote DoS (2012-0119)
78380	Oracle MySQL Server Unspecified Remote DoS (2012-0115)
78379	Oracle MySQL Server Unspecified Remote DoS (2012-0102)
78378	Oracle MySQL Server Unspecified Remote DoS (2012-0101)
78377	Oracle MySQL Server Unspecified Remote DoS (2012-0087)
78376	Oracle MySQL Server Unspecified Remote DoS (2011-2262)
78374	Oracle MySQL Server Unspecified Remote Issue (2012-0075)
78373	Oracle MySQL Server Unspecified Local Issue
78372	Oracle MySQL Server Unspecified Remote Information Disclosure
78370	Oracle MySQL Server Unspecified Remote Issue (2012-0118)
78369	Oracle MySQL Server Unspecified Remote Issue (2012-0116)
78368	Oracle MySQL Server Unspecified Remote Issue (2012-0113)

Type	Count
CPE ID(s)	200
osvdb(s)	17

Related	Severity
CVE-2012-0113	(Medium)
CVE-2011-2262	(Medium)
CVE-2012-0118	(Medium)
CVE-2012-0116	(Medium)
CVE-2012-0490	(Medium)
CVE-2012-0485	(Medium)
CVE-2012-0484	(Medium)
CVE-2012-0120	(Medium)
CVE-2012-0119	(Medium)
CVE-2012-0115	(Medium)
CVE-2012-0102	(Medium)
CVE-2012-0101	(Medium)
CVE-2012-0087	(Medium)
CVE-2012-0112	(Low)
CVE-2012-0114	(Low)
CVE-2012-0492	(Low)
CVE-2012-0075	(Low)