Executive Summary
Summary | |
---|---|
Title | MySQL vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-528-1 | First vendor Publication | 2007-10-11 |
Vendor | Ubuntu | Last vendor Modification | 2007-10-11 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
---|---|---|---|
Cvss Base Score | 5 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 6.10 Ubuntu 7.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: Ubuntu 6.10: Ubuntu 7.04: In general, a standard system upgrade is sufficient to affect the necessary changes. ATTENTION: A change was made to the init script for mysql. Now on start-up, mysql is checked to make sure that the mysql root password is set. If it is blank, a message is sent to the console and the system logger alerting that the password is not set, along with instructions on how to set it. Additionally, you can now use: sudo /etc/init.d/mysql reset-password to set the root mysql user's password. Details follow: Neil Kettle discovered that MySQL could be made to dereference a NULL pointer and divide by zero. An authenticated user could exploit this with a crafted IF clause, leading to a denial of service. (CVE-2007-2583) Victoria Reznichenko discovered that MySQL did not always require the DROP privilege. An authenticated user could exploit this via RENAME TABLE statements to rename arbitrary tables, possibly gaining additional database access. (CVE-2007-2691) It was discovered that MySQL could be made to overflow a signed char during authentication. Remote attackers could use crafted authentication requests to cause a denial of service. (CVE-2007-3780) Phil Anderton discovered that MySQL did not properly verify access privileges when accessing external tables. As a result, authenticated users could exploit this to obtain UPDATE privileges to external tables. (CVE-2007-3782) In certain situations, when installing or upgrading mysql, there was no notification that the mysql root user password needed to be set. If the password was left unset, attackers would be able to obtain unrestricted access to mysql. This is now checked during mysql start-up. |
Original Source
Url : http://www.ubuntu.com/usn/USN-528-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-264 | Permissions, Privileges, and Access Controls |
50 % | CWE-20 | Improper Input Validation |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10563 | |||
Oval ID: | oval:org.mitre.oval:def:10563 | ||
Title: | MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a table in another database via a view that refers to this external table. | ||
Description: | MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a table in another database via a view that refers to this external table. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-3782 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:11058 | |||
Oval ID: | oval:org.mitre.oval:def:11058 | ||
Title: | MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service (daemon crash) via a malformed password packet in the connection protocol. | ||
Description: | MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service (daemon crash) via a malformed password packet in the connection protocol. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-3780 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:17461 | |||
Oval ID: | oval:org.mitre.oval:def:17461 | ||
Title: | USN-528-1 -- mysql-dfsg-5.0 vulnerabilities | ||
Description: | Neil Kettle discovered that MySQL could be made to dereference a NULL pointer and divide by zero. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-528-1 CVE-2007-2583 CVE-2007-2691 CVE-2007-3780 CVE-2007-3782 | Version: | 7 |
Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 | Product(s): | mysql-dfsg-5.0 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22310 | |||
Oval ID: | oval:org.mitre.oval:def:22310 | ||
Title: | ELSA-2008:0364: mysql security and bug fix update (Low) | ||
Description: | MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a table in another database via a view that refers to this external table. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2008:0364-01 CVE-2006-0903 CVE-2006-4031 CVE-2006-4227 CVE-2006-7232 CVE-2007-1420 CVE-2007-2583 CVE-2007-2691 CVE-2007-2692 CVE-2007-3781 CVE-2007-3782 | Version: | 45 |
Platform(s): | Oracle Linux 5 | Product(s): | mysql |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:22681 | |||
Oval ID: | oval:org.mitre.oval:def:22681 | ||
Title: | ELSA-2007:0875: mysql security update (Important) | ||
Description: | MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service (daemon crash) via a malformed password packet in the connection protocol. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2007:0875-02 CVE-2007-3780 | Version: | 6 |
Platform(s): | Oracle Linux 5 | Product(s): | mysql |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:9559 | |||
Oval ID: | oval:org.mitre.oval:def:9559 | ||
Title: | MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables. | ||
Description: | MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-2691 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9930 | |||
Oval ID: | oval:org.mitre.oval:def:9930 | ||
Title: | The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-dependent attackers to cause a denial of service (crash) via a crafted IF clause that results in a divide-by-zero error and a NULL pointer dereference. | ||
Description: | The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-dependent attackers to cause a denial of service (crash) via a crafted IF clause that results in a divide-by-zero error and a NULL pointer dereference. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-2583 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2010-05-12 | Name : Mac OS X Security Update 2008-007 File : nvt/macosx_secupd_2008-007.nasl |
2009-10-10 | Name : SLES9: Security update for MySQL File : nvt/sles9p5021882.nasl |
2009-04-09 | Name : Mandriva Update for MySQL MDKSA-2007:139 (MySQL) File : nvt/gb_mandriva_MDKSA_2007_139.nasl |
2009-04-09 | Name : Mandriva Update for MySQL MDKSA-2007:177 (MySQL) File : nvt/gb_mandriva_MDKSA_2007_177.nasl |
2009-03-23 | Name : Ubuntu Update for mysql-dfsg-5.0 vulnerabilities USN-528-1 File : nvt/gb_ubuntu_USN_528_1.nasl |
2009-03-06 | Name : RedHat Update for mysql RHSA-2008:0364-01 File : nvt/gb_RHSA-2008_0364-01_mysql.nasl |
2009-03-06 | Name : RedHat Update for mysql RHSA-2008:0768-01 File : nvt/gb_RHSA-2008_0768-01_mysql.nasl |
2009-01-13 | Name : FreeBSD Ports: mysql-server File : nvt/freebsd_mysql-server18.nasl |
2009-01-13 | Name : FreeBSD Ports: mysql-server File : nvt/freebsd_mysql-server19.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200708-10 (mysql) File : nvt/glsa_200708_10.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 1413-1 (mysql-dfsg, mysql-dfsg-5.0, mysql-dfsg-4.1) File : nvt/deb_1413_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
37782 | MySQL Community Server External Table View Privilege Escalation |
36732 | MySQL Community Server Connection Protocol Malformed Password Packet Remote DoS |
34766 | MySQL RENAME TABLE Statement Arbitrary Table Name Modification |
34734 | MySQL Crafted IF Clause Divide-by-zero NULL Dereference DoS |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0875.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080724_mysql_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080521_mysql_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070830_mysql_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2012-01-18 | Name : The remote database server is affected by an access control vulnerability. File : mysql_4_1_23_5_0_42.nasl - Type : ACT_GATHER_INFO |
2012-01-18 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_0_40.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12044.nasl - Type : ACT_GATHER_INFO |
2009-01-12 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_240ac24cdff311dda7650030843d3802.nasl - Type : ACT_GATHER_INFO |
2009-01-12 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_bb4e9a44dff211dda7650030843d3802.nasl - Type : ACT_GATHER_INFO |
2008-10-10 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-007.nasl - Type : ACT_GATHER_INFO |
2008-07-25 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0768.nasl - Type : ACT_GATHER_INFO |
2008-05-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0364.nasl - Type : ACT_GATHER_INFO |
2008-02-05 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mysql-4879.nasl - Type : ACT_GATHER_INFO |
2008-02-05 | Name : The remote openSUSE host is missing a security update. File : suse_libmysqlclient-devel-4873.nasl - Type : ACT_GATHER_INFO |
2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mysql-4376.nasl - Type : ACT_GATHER_INFO |
2007-11-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1413.nasl - Type : ACT_GATHER_INFO |
2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-528-1.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_mysql-4375.nasl - Type : ACT_GATHER_INFO |
2007-09-07 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-177.nasl - Type : ACT_GATHER_INFO |
2007-09-03 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0875.nasl - Type : ACT_GATHER_INFO |
2007-09-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0875.nasl - Type : ACT_GATHER_INFO |
2007-08-21 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200708-10.nasl - Type : ACT_GATHER_INFO |
2007-07-25 | Name : The remote database server is susceptible to multiple attacks. File : mysql_5_0_45.nasl - Type : ACT_GATHER_INFO |
2007-07-05 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-139.nasl - Type : ACT_GATHER_INFO |
2007-05-17 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_1_18.nasl - Type : ACT_GATHER_INFO |
2007-05-10 | Name : The remote database server is prone to a denial of service attack. File : mysql_select_if_dos.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 12:04:41 |
|