CVE-2008-4098 mysql: incomplete upstream fix for CVE-2008-2079

CVE-2008-4456 mysql: mysql command line client XSS flaw

CVE-2009-2446 MySQL: Format string vulnerability by manipulation with database instances (crash)

CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098

Multiple flaws were discovered in the way MySQL handled symbolic links to tables created using the DATA DIRECTORY and INDEX DIRECTORY directives in CREATE TABLE statements. An attacker with CREATE and DROP table privileges and shell access to the database server could use these flaws to escalate their database privileges, or gain access to tables created by other database users. (CVE-2008-4098, CVE-2009-4030)

Note: Due to the security risks and previous security issues related to the use of the DATA DIRECTORY and INDEX DIRECTORY directives, users not depending on this feature should consider disabling it by adding 'symbolic-links=0' to the '[mysqld]' section of the 'my.cnf' configuration file. In this update, an example of such a configuration was added to the default 'my.cnf' file.

An insufficient HTML entities quoting flaw was found in the mysql command line client's HTML output mode. If an attacker was able to inject arbitrary HTML tags into data stored in a MySQL database, which was later retrieved using the mysql command line client and its HTML output mode, they could perform a cross-site scripting (XSS) attack against victims viewing the HTML output in a web browser.
(CVE-2008-4456)

Multiple format string flaws were found in the way the MySQL server logged user commands when creating and deleting databases. A remote, authenticated attacker with permissions to CREATE and DROP databases could use these flaws to formulate a specially crafted SQL command that would cause a temporary denial of service (open connections to mysqld are terminated). (CVE-2009-2446)

Note: To exploit the CVE-2009-2446 flaws, the general query log (the mysqld '--log' command line option or the 'log' option in 'my.cnf') must be enabled. This logging is not enabled by default.

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

Updated mysql packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

MySQL did not correctly check directories used as arguments for the DATA DIRECTORY and INDEX DIRECTORY directives. Using this flaw, an authenticated attacker could elevate their access privileges to tables created by other database users. Note: This attack does not work on existing tables. An attacker can only elevate their access to another user's tables as the tables are created. As well, the names of these created tables need to be predicted correctly for this attack to succeed. (CVE-2008-2079)

A flaw was found in the way MySQL handles an empty bit-string literal.
A remote, authenticated attacker could crash the MySQL server daemon (mysqld) if they used an empty bit-string literal in a SQL statement.
This issue only caused a temporary denial of service, as the MySQL daemon was automatically restarted after the crash. (CVE-2008-3963)

An insufficient HTML entities quoting flaw was found in the mysql command line client's HTML output mode. If an attacker was able to inject arbitrary HTML tags into data stored in a MySQL database, which was later retrieved using the mysql command line client and its HTML output mode, they could perform a cross-site scripting (XSS) attack against victims viewing the HTML output in a web browser.
(CVE-2008-4456)

Multiple format string flaws were found in the way the MySQL server logs user commands when creating and deleting databases. A remote, authenticated attacker with permissions to CREATE and DROP databases could use these flaws to formulate a specifically-crafted SQL command that would cause a temporary denial of service (open connections to mysqld are terminated). (CVE-2009-2446)

Note: To exploit the CVE-2009-2446 flaws, the general query log (the mysqld '--log' command line option or the 'log' option in '/etc/my.cnf') must be enabled. This logging is not enabled by default.

This update also fixes multiple bugs. Details regarding these bugs can be found in the Red Hat Enterprise Linux 5.4 Technical Notes. You can find a link to the Technical Notes in the References section of this errata.

Note: These updated packages upgrade MySQL to version 5.0.77 to incorporate numerous upstream bug fixes. Details of these changes are found in the following MySQL Release Notes:
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-77.html

All MySQL users are advised to upgrade to these updated packages, which resolve these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

From Red Hat Security Advisory 2010:0110 :

Updated mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

Multiple flaws were discovered in the way MySQL handled symbolic links to tables created using the DATA DIRECTORY and INDEX DIRECTORY directives in CREATE TABLE statements. An attacker with CREATE and DROP table privileges and shell access to the database server could use these flaws to escalate their database privileges, or gain access to tables created by other database users. (CVE-2008-4098, CVE-2009-4030)

Note: Due to the security risks and previous security issues related to the use of the DATA DIRECTORY and INDEX DIRECTORY directives, users not depending on this feature should consider disabling it by adding 'symbolic-links=0' to the '[mysqld]' section of the 'my.cnf' configuration file. In this update, an example of such a configuration was added to the default 'my.cnf' file.

An insufficient HTML entities quoting flaw was found in the mysql command line client's HTML output mode. If an attacker was able to inject arbitrary HTML tags into data stored in a MySQL database, which was later retrieved using the mysql command line client and its HTML output mode, they could perform a cross-site scripting (XSS) attack against victims viewing the HTML output in a web browser.
(CVE-2008-4456)

Multiple format string flaws were found in the way the MySQL server logged user commands when creating and deleting databases. A remote, authenticated attacker with permissions to CREATE and DROP databases could use these flaws to formulate a specially crafted SQL command that would cause a temporary denial of service (open connections to mysqld are terminated). (CVE-2009-2446)

Note: To exploit the CVE-2009-2446 flaws, the general query log (the mysqld '--log' command line option or the 'log' option in 'my.cnf') must be enabled. This logging is not enabled by default.

All MySQL users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

A vulnerability has been found and corrected in mysql :

Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained from third-party information (CVE-2009-2446).

This update provides fixes for this vulnerability.

- the COM_CREATE_DB and COM_DROP_DB suffered from format     string vulnerabilities (CVE-2009-2446)

  - the command line client was prone to cross-site     scripting (XSS) attacks (CVE-2008-4456)

  - fix slave reconnect

In MySQL 4.0.0 through 5.0.83, multiple format string vulnerabilities in the dispatch_command() function in libmysqld/sql_parse.cc in mysqld allow remote authenticated users to cause a denial of service (daemon crash) and potentially the execution of arbitrary code via format string specifiers in a database name in a COM_CREATE_DB or COM_DROP_DB request.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
60735	Scientific Linux Security Update : mysql on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
43782	CentOS 5 : mysql (CESA-2009:1289)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	high
67998	Oracle Linux 4 : mysql (ELSA-2010-0110)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical
40397	Mandriva Linux Security Advisory : mysql (MDVSA-2009:159)	Nessus	Mandriva Local Security Checks	2009/7/28	2021/1/6	high
40790	openSUSE Security Update : libmysqlclient-devel (libmysqlclient-devel-1116)	Nessus	SuSE Local Security Checks	2009/8/27	2021/1/14	high
44742	Debian DSA-1877-1 : mysql-dfsg-5.0 - denial of service/execution of arbitrary code	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
63890	RHEL 5 : mysql (RHSA-2009:1289)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high

检测

插件搜索

high

high

high

critical

high

high

high

high