Executive Summary
| Summary | |
|---|---|
| Title | Updated mysql packages fix vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2008:150 | First vendor Publication | 2008-07-19 |
| Vendor | Mandriva | Last vendor Modification | 2008-07-19 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple buffer overflows in yaSSL, which is used in MySQL, allowed remote attackers to execute arbitrary code (CVE-2008-0226) or cause a denial of service via a special Hello packet (CVE-2008-0227). Sergei Golubchik found that MySQL did not properly validate optional data or index directory paths given in a CREATE TABLE statement; as well it would not, under certain conditions, prevent two databases from using the same paths for data or index files. This could allow an authenticated user with appropriate privilege to create tables in one database to read and manipulate data in tables later created in other databases, regardless of GRANT privileges (CVE-2008-2079). The updated packages have been patched to correct these issues. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2008:150 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 67 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 33 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10133 | |||
| Oval ID: | oval:org.mitre.oval:def:10133 | ||
| Title: | MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future. | ||
| Description: | MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-2079 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17775 | |||
| Oval ID: | oval:org.mitre.oval:def:17775 | ||
| Title: | USN-588-1 -- mysql-dfsg-5.0 vulnerabilities | ||
| Description: | Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-588-1 CVE-2006-7232 CVE-2007-2692 CVE-2007-6303 CVE-2008-0226 CVE-2008-0227 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 | Product(s): | mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17802 | |||
| Oval ID: | oval:org.mitre.oval:def:17802 | ||
| Title: | USN-588-2 -- mysql-dfsg-5.0 regression | ||
| Description: | USN-588-1 fixed vulnerabilities in MySQL. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-588-2 CVE-2007-2692 CVE-2006-7232 CVE-2007-6303 CVE-2008-0226 CVE-2008-0227 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 | Product(s): | mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:18619 | |||
| Oval ID: | oval:org.mitre.oval:def:18619 | ||
| Title: | DSA-1608-1 mysql-dfsg-5.0 - authorisation bypass | ||
| Description: | Sergei Golubchik discovered that MySQL, a widely-deployed database server, did not properly validate optional data or index directory paths given in a CREATE TABLE statement, nor would it (under proper conditions) prevent two databases from using the same paths for data or index files. This permits an authenticated user with authorisation to create tables in one database to read, write or delete data from tables subsequently created in other databases, regardless of other GRANT authorisations. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1608-1 CVE-2008-2079 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:19935 | |||
| Oval ID: | oval:org.mitre.oval:def:19935 | ||
| Title: | DSA-1478-1 mysql-dfsg-5.0 - buffer overflows | ||
| Description: | Luigi Auriemma discovered two buffer overflows in YaSSL, an SSL implementation included in the MySQL database package, which could lead to denial of service and possibly the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1478-1 CVE-2008-0226 CVE-2008-0227 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7917 | |||
| Oval ID: | oval:org.mitre.oval:def:7917 | ||
| Title: | DSA-1608 mysql-dfsg-5.0 -- authorisation bypass | ||
| Description: | Sergei Golubchik discovered that MySQL, a widely-deployed database server, did not properly validate optional data or index directory paths given in a CREATE TABLE statement, nor would it (under proper conditions) prevent two databases from using the same paths for data or index files. This permits an authenticated user with authorisation to create tables in one database to read, write or delete data from tables subsequently created in other databases, regardless of other GRANT authorisations. The Common Vulnerabilities and Exposures project identifies this weakness as CVE-2008-2079. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1608 CVE-2008-2079 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:8173 | |||
| Oval ID: | oval:org.mitre.oval:def:8173 | ||
| Title: | DSA-1478 mysql-dfsg-5.0 -- buffer overflows | ||
| Description: | Luigi Auriemma discovered two buffer overflows in YaSSL, an SSL implementation included in the MySQL database package, which could lead to denial of service and possibly the execution of arbitrary code. The old stable distribution (sarge) doesn't contain mysql-dfsg-5.0. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1478 CVE-2008-0226 CVE-2008-0227 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
SAINT Exploits
| Description | Link |
|---|---|
| MySQL yaSSL SSL Hello message buffer overflow | More info here |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for mysql CESA-2009:1289 centos5 i386 File : nvt/gb_CESA-2009_1289_mysql_centos5_i386.nasl |
| 2011-08-09 | Name : CentOS Update for mysql CESA-2010:0109 centos5 i386 File : nvt/gb_CESA-2010_0109_mysql_centos5_i386.nasl |
| 2010-05-12 | Name : Mac OS X Security Update 2009-005 File : nvt/macosx_secupd_2009-005.nasl |
| 2010-05-12 | Name : Mac OS X Security Update 2008-007 File : nvt/macosx_secupd_2008-007.nasl |
| 2010-02-19 | Name : CentOS Update for mysql CESA-2010:0110 centos4 i386 File : nvt/gb_CESA-2010_0110_mysql_centos4_i386.nasl |
| 2010-02-19 | Name : RedHat Update for mysql RHSA-2010:0109-01 File : nvt/gb_RHSA-2010_0109-01_mysql.nasl |
| 2010-02-19 | Name : RedHat Update for mysql RHSA-2010:0110-01 File : nvt/gb_RHSA-2010_0110-01_mysql.nasl |
| 2010-01-19 | Name : Mandriva Update for mysql MDVSA-2010:012 (mysql) File : nvt/gb_mandriva_MDVSA_2010_012.nasl |
| 2010-01-19 | Name : Mandriva Update for mysql MDVSA-2010:011 (mysql) File : nvt/gb_mandriva_MDVSA_2010_011.nasl |
| 2009-10-13 | Name : SLES10: Security update for MySQL File : nvt/sles10_mysql1.nasl |
| 2009-10-10 | Name : SLES9: Security update for MySQL File : nvt/sles9p5032620.nasl |
| 2009-09-21 | Name : CentOS Security Advisory CESA-2009:1289 (mysql) File : nvt/ovcesa2009_1289.nasl |
| 2009-09-09 | Name : RedHat Security Advisory RHSA-2009:1289 File : nvt/RHSA_2009_1289.nasl |
| 2009-06-05 | Name : RedHat Security Advisory RHSA-2009:1067 File : nvt/RHSA_2009_1067.nasl |
| 2009-06-05 | Name : Ubuntu USN-763-1 (xine-lib) File : nvt/ubuntu_763_1.nasl |
| 2009-04-28 | Name : Mandrake Security Advisory MDVSA-2009:094 (mysql) File : nvt/mdksa_2009_094.nasl |
| 2009-04-23 | Name : MySQL MyISAM Table Privileges Secuity Bypass Vulnerability File : nvt/mysql_29106.nasl |
| 2009-04-09 | Name : Mandriva Update for mysql MDVSA-2008:150 (mysql) File : nvt/gb_mandriva_MDVSA_2008_150.nasl |
| 2009-04-09 | Name : Mandriva Update for mysql MDVSA-2008:149 (mysql) File : nvt/gb_mandriva_MDVSA_2008_149.nasl |
| 2009-03-23 | Name : Ubuntu Update for mysql-dfsg-5.0 vulnerabilities USN-588-1 File : nvt/gb_ubuntu_USN_588_1.nasl |
| 2009-03-23 | Name : Ubuntu Update for mysql-dfsg-5.0 regression USN-588-2 File : nvt/gb_ubuntu_USN_588_2.nasl |
| 2009-03-23 | Name : Ubuntu Update for mysql-dfsg-5.0 vulnerabilities USN-671-1 File : nvt/gb_ubuntu_USN_671_1.nasl |
| 2009-03-06 | Name : RedHat Update for mysql RHSA-2008:0768-01 File : nvt/gb_RHSA-2008_0768-01_mysql.nasl |
| 2009-01-23 | Name : SuSE Update for openwsman SUSE-SA:2008:041 File : nvt/gb_suse_2008_041.nasl |
| 2009-01-02 | Name : FreeBSD Ports: mysql-server File : nvt/freebsd_mysql-server15.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200809-04 (mysql) File : nvt/glsa_200809_04.nasl |
| 2008-09-17 | Name : FreeBSD Ports: mysql-server File : nvt/freebsd_mysql-server14.nasl |
| 2008-07-15 | Name : Debian Security Advisory DSA 1608-1 (mysql-dfsg-5.0) File : nvt/deb_1608_1.nasl |
| 2008-01-31 | Name : Debian Security Advisory DSA 1478-1 (mysql-dfsg-5.0) File : nvt/deb_1478_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 44937 | MySQL MyISAM Table CREATE TABLE Privilege Check Bypass |
| 41935 | yaSSL hash.cpp HASHwithTransform::Update Function Remote Overflow yaSSL contains a flaw that may allow a remote denial of service. The issue is triggered by an invalid Hello packet which is handled by the HASHwithTransform::Update function, and will result in loss of availability for the service. |
| 41197 | yaSSL hash.cpp HASHwithTransform::Update Function Hello Packet Overflow DoS |
| 41196 | yaSSL yassl_imp.cpp input_buffer& operator>> Remote Overflow |
| 41195 | yaSSL handshake.cpp ProcessOldClientHello Function Remote Overflow A remote overflow exists in yaSSL. The ProcessOldClientHello function fails to validate Hello packets resulting in a buffer overflow. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2020-01-07 | yaSSL SSL Hello Message buffer overflow attempt RuleID : 52366 - Revision : 1 - Type : SERVER-MYSQL |
| 2014-01-10 | yaSSL SSL Hello Message Buffer Overflow attempt RuleID : 18513 - Revision : 13 - Type : SERVER-MYSQL |
| 2014-01-10 | yaSSL SSLv3 Client Hello Message Cipher Specs Buffer Overflow attempt RuleID : 13714 - Revision : 16 - Type : SERVER-MYSQL |
| 2014-01-10 | yaSSL SSLv2 Client Hello Message Challenge Buffer Overflow attempt RuleID : 13713 - Revision : 9 - Type : MYSQL |
| 2014-01-10 | yaSSL SSLv2 Client Hello Message Session ID Buffer Overflow attempt RuleID : 13712 - Revision : 9 - Type : MYSQL |
| 2014-01-10 | yaSSL SSLv2 Client Hello Message Cipher Length Buffer Overflow attempt RuleID : 13711 - Revision : 9 - Type : MYSQL |
| 2014-01-10 | yaSSL SSL Hello Message Buffer Overflow attempt RuleID : 13593 - Revision : 7 - Type : MYSQL |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0110.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0109.nasl - Type : ACT_GATHER_INFO |
| 2013-01-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1289.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100216_mysql_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100216_mysql_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090902_mysql_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080724_mysql_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-01-16 | Name : Arbitrary code can be executed on the remote database server. File : mysql_6_0_4_yaSSL.nasl - Type : ACT_GATHER_INFO |
| 2012-01-16 | Name : The remote database server allows a local user to circumvent privileges. File : mysql_6_0_14_priv_bypass.nasl - Type : ACT_GATHER_INFO |
| 2010-07-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-012.nasl - Type : ACT_GATHER_INFO |
| 2010-03-02 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0109.nasl - Type : ACT_GATHER_INFO |
| 2010-02-18 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0110.nasl - Type : ACT_GATHER_INFO |
| 2010-02-17 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0110.nasl - Type : ACT_GATHER_INFO |
| 2010-02-17 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0109.nasl - Type : ACT_GATHER_INFO |
| 2010-01-18 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-011.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1289.nasl - Type : ACT_GATHER_INFO |
| 2009-11-25 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_1_41.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12175.nasl - Type : ACT_GATHER_INFO |
| 2009-09-11 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2009-005.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-094.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-671-1.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-150.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-149.nasl - Type : ACT_GATHER_INFO |
| 2008-12-30 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_738f8f9ed66111dda7650030843d3802.nasl - Type : ACT_GATHER_INFO |
| 2008-11-09 | Name : The remote database server is susceptible to a privilege bypass attack. File : mysql_es_5_0_70.nasl - Type : ACT_GATHER_INFO |
| 2008-10-10 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-007.nasl - Type : ACT_GATHER_INFO |
| 2008-09-11 | Name : The remote database server is affected by several issues. File : mysql_5_0_67.nasl - Type : ACT_GATHER_INFO |
| 2008-09-10 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_388d9ee47f2211dda66a0019666436c2.nasl - Type : ACT_GATHER_INFO |
| 2008-09-05 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200809-04.nasl - Type : ACT_GATHER_INFO |
| 2008-08-14 | Name : The remote openSUSE host is missing a security update. File : suse_libmysqlclient-devel-5341.nasl - Type : ACT_GATHER_INFO |
| 2008-08-14 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mysql-5338.nasl - Type : ACT_GATHER_INFO |
| 2008-07-25 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0768.nasl - Type : ACT_GATHER_INFO |
| 2008-07-15 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1608.nasl - Type : ACT_GATHER_INFO |
| 2008-05-09 | Name : The remote database server allows a local user to circumvent privileges. File : mysql_4_1_24.nasl - Type : ACT_GATHER_INFO |
| 2008-05-09 | Name : The remote database server allows a local user to circumvent privileges. File : mysql_es_5_0_60.nasl - Type : ACT_GATHER_INFO |
| 2008-04-04 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-588-2.nasl - Type : ACT_GATHER_INFO |
| 2008-03-21 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-588-1.nasl - Type : ACT_GATHER_INFO |
| 2008-01-30 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1478.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:39:32 |
|
