Executive Summary
Summary | |
---|---|
Title | MySQL vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-588-1 | First vendor Publication | 2008-03-19 |
Vendor | Ubuntu | Last vendor Modification | 2008-03-19 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: Ubuntu 6.10: Ubuntu 7.04: Ubuntu 7.10: In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232) Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges. This issue does not affect Ubuntu 7.10. (CVE-2007-2692) Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303) Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227) |
Original Source
Url : http://www.ubuntu.com/usn/USN-588-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
67 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
33 % | CWE-89 | Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:11720 | |||
Oval ID: | oval:org.mitre.oval:def:11720 | ||
Title: | sql_select.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to cause a denial of service (crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table, as originally demonstrated using ORDER BY. | ||
Description: | sql_select.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to cause a denial of service (crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table, as originally demonstrated using ORDER BY. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2006-7232 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:17775 | |||
Oval ID: | oval:org.mitre.oval:def:17775 | ||
Title: | USN-588-1 -- mysql-dfsg-5.0 vulnerabilities | ||
Description: | Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-588-1 CVE-2006-7232 CVE-2007-2692 CVE-2007-6303 CVE-2008-0226 CVE-2008-0227 | Version: | 7 |
Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 | Product(s): | mysql-dfsg-5.0 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:17802 | |||
Oval ID: | oval:org.mitre.oval:def:17802 | ||
Title: | USN-588-2 -- mysql-dfsg-5.0 regression | ||
Description: | USN-588-1 fixed vulnerabilities in MySQL. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-588-2 CVE-2007-2692 CVE-2006-7232 CVE-2007-6303 CVE-2008-0226 CVE-2008-0227 | Version: | 7 |
Platform(s): | Ubuntu 6.06 | Product(s): | mysql-dfsg-5.0 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:19935 | |||
Oval ID: | oval:org.mitre.oval:def:19935 | ||
Title: | DSA-1478-1 mysql-dfsg-5.0 - buffer overflows | ||
Description: | Luigi Auriemma discovered two buffer overflows in YaSSL, an SSL implementation included in the MySQL database package, which could lead to denial of service and possibly the execution of arbitrary code. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1478-1 CVE-2008-0226 CVE-2008-0227 | Version: | 5 |
Platform(s): | Debian GNU/Linux 4.0 | Product(s): | mysql-dfsg-5.0 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:8173 | |||
Oval ID: | oval:org.mitre.oval:def:8173 | ||
Title: | DSA-1478 mysql-dfsg-5.0 -- buffer overflows | ||
Description: | Luigi Auriemma discovered two buffer overflows in YaSSL, an SSL implementation included in the MySQL database package, which could lead to denial of service and possibly the execution of arbitrary code. The old stable distribution (sarge) doesn't contain mysql-dfsg-5.0. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1478 CVE-2008-0226 CVE-2008-0227 | Version: | 3 |
Platform(s): | Debian GNU/Linux 4.0 | Product(s): | mysql-dfsg-5.0 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9166 | |||
Oval ID: | oval:org.mitre.oval:def:9166 | ||
Title: | The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges. | ||
Description: | The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-2692 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
SAINT Exploits
Description | Link |
---|---|
MySQL yaSSL SSL Hello message buffer overflow | More info here |
OpenVAS Exploits
Date | Description |
---|---|
2010-05-12 | Name : Mac OS X Security Update 2008-007 File : nvt/macosx_secupd_2008-007.nasl |
2009-10-13 | Name : SLES10: Security update for MySQL File : nvt/sles10_mysql1.nasl |
2009-10-10 | Name : SLES9: Security update for MySQL File : nvt/sles9p5021882.nasl |
2009-10-10 | Name : SLES9: Security update for MySQL File : nvt/sles9p5032620.nasl |
2009-04-09 | Name : Mandriva Update for mysql MDVSA-2008:017 (mysql) File : nvt/gb_mandriva_MDVSA_2008_017.nasl |
2009-04-09 | Name : Mandriva Update for mysql MDVSA-2008:028 (mysql) File : nvt/gb_mandriva_MDVSA_2008_028.nasl |
2009-04-09 | Name : Mandriva Update for mysql MDVSA-2008:150 (mysql) File : nvt/gb_mandriva_MDVSA_2008_150.nasl |
2009-03-23 | Name : Ubuntu Update for mysql-dfsg-5.0 vulnerabilities USN-588-1 File : nvt/gb_ubuntu_USN_588_1.nasl |
2009-03-23 | Name : Ubuntu Update for mysql-dfsg-5.0 regression USN-588-2 File : nvt/gb_ubuntu_USN_588_2.nasl |
2009-03-06 | Name : RedHat Update for mysql RHSA-2008:0364-01 File : nvt/gb_RHSA-2008_0364-01_mysql.nasl |
2009-02-27 | Name : Fedora Update for mysql FEDORA-2007-4465 File : nvt/gb_fedora_2007_4465_mysql_fc8.nasl |
2009-02-27 | Name : Fedora Update for mysql FEDORA-2007-4471 File : nvt/gb_fedora_2007_4471_mysql_fc7.nasl |
2009-01-23 | Name : SuSE Update for openwsman SUSE-SA:2008:041 File : nvt/gb_suse_2008_041.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200804-04 (mysql) File : nvt/glsa_200804_04.nasl |
2008-01-31 | Name : Debian Security Advisory DSA 1478-1 (mysql-dfsg-5.0) File : nvt/deb_1478_1.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 1413-1 (mysql-dfsg, mysql-dfsg-5.0, mysql-dfsg-4.1) File : nvt/deb_1413_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
43180 | MySQL sql_select.cc INFORMATION_SCHEMA Table Crafted Query Remote DoS |
42610 | MySQL DEFINER View Value Crafted Statements Remote Privilege Escalation |
41935 | yaSSL hash.cpp HASHwithTransform::Update Function Remote Overflow yaSSL contains a flaw that may allow a remote denial of service. The issue is triggered by an invalid Hello packet which is handled by the HASHwithTransform::Update function, and will result in loss of availability for the service. |
41197 | yaSSL hash.cpp HASHwithTransform::Update Function Hello Packet Overflow DoS |
41196 | yaSSL yassl_imp.cpp input_buffer& operator>> Remote Overflow |
41195 | yaSSL handshake.cpp ProcessOldClientHello Function Remote Overflow A remote overflow exists in yaSSL. The ProcessOldClientHello function fails to validate Hello packets resulting in a buffer overflow. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity. |
34765 | MySQL mysql_change_db Function THD::db_access Privilege Escalation |
Snort® IPS/IDS
Date | Description |
---|---|
2020-01-07 | yaSSL SSL Hello Message buffer overflow attempt RuleID : 52366 - Revision : 1 - Type : SERVER-MYSQL |
2014-01-10 | yaSSL SSL Hello Message Buffer Overflow attempt RuleID : 18513 - Revision : 13 - Type : SERVER-MYSQL |
2014-01-10 | yaSSL SSLv3 Client Hello Message Cipher Specs Buffer Overflow attempt RuleID : 13714 - Revision : 16 - Type : SERVER-MYSQL |
2014-01-10 | yaSSL SSLv2 Client Hello Message Challenge Buffer Overflow attempt RuleID : 13713 - Revision : 9 - Type : MYSQL |
2014-01-10 | yaSSL SSLv2 Client Hello Message Session ID Buffer Overflow attempt RuleID : 13712 - Revision : 9 - Type : MYSQL |
2014-01-10 | yaSSL SSLv2 Client Hello Message Cipher Length Buffer Overflow attempt RuleID : 13711 - Revision : 9 - Type : MYSQL |
2014-01-10 | yaSSL SSL Hello Message Buffer Overflow attempt RuleID : 13593 - Revision : 7 - Type : MYSQL |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-10-10 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL8178.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080521_mysql_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2012-01-18 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_0_40.nasl - Type : ACT_GATHER_INFO |
2012-01-16 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_6_0_4.nasl - Type : ACT_GATHER_INFO |
2012-01-16 | Name : Arbitrary code can be executed on the remote database server. File : mysql_6_0_4_yaSSL.nasl - Type : ACT_GATHER_INFO |
2012-01-16 | Name : The remote database server is vulnerable to a denial of service attack. File : mysql_5_1_14.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12175.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12044.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-017.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-028.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-150.nasl - Type : ACT_GATHER_INFO |
2008-10-10 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-007.nasl - Type : ACT_GATHER_INFO |
2008-09-11 | Name : The remote database server is affected by several issues. File : mysql_5_0_67.nasl - Type : ACT_GATHER_INFO |
2008-08-14 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mysql-5338.nasl - Type : ACT_GATHER_INFO |
2008-08-14 | Name : The remote openSUSE host is missing a security update. File : suse_libmysqlclient-devel-5341.nasl - Type : ACT_GATHER_INFO |
2008-05-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0364.nasl - Type : ACT_GATHER_INFO |
2008-04-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200804-04.nasl - Type : ACT_GATHER_INFO |
2008-04-04 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-588-2.nasl - Type : ACT_GATHER_INFO |
2008-03-21 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-588-1.nasl - Type : ACT_GATHER_INFO |
2008-02-05 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mysql-4879.nasl - Type : ACT_GATHER_INFO |
2008-02-05 | Name : The remote openSUSE host is missing a security update. File : suse_libmysqlclient-devel-4873.nasl - Type : ACT_GATHER_INFO |
2008-01-30 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1478.nasl - Type : ACT_GATHER_INFO |
2007-12-17 | Name : The remote Fedora host is missing a security update. File : fedora_2007-4465.nasl - Type : ACT_GATHER_INFO |
2007-12-17 | Name : The remote Fedora host is missing a security update. File : fedora_2007-4471.nasl - Type : ACT_GATHER_INFO |
2007-12-13 | Name : The remote database server is affected by several issues. File : mysql_enterprise_5_0_52.nasl - Type : ACT_GATHER_INFO |
2007-12-13 | Name : The remote database server is affected by several issues. File : mysql_5_1_23.nasl - Type : ACT_GATHER_INFO |
2007-11-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1413.nasl - Type : ACT_GATHER_INFO |
2007-09-07 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-177.nasl - Type : ACT_GATHER_INFO |
2007-05-17 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_1_18.nasl - Type : ACT_GATHER_INFO |
2007-05-10 | Name : The remote database server is prone to a denial of service attack. File : mysql_select_if_dos.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 12:04:58 |
|