mysql security update

Advisory:	RHSA-2004:597-06
Type:	Security Advisory
Severity:	Important
Issued on:	2004-10-20
Last updated on:	2004-10-20
Affected Products:	Red Hat Enterprise Linux AS (v. 2.1) Red Hat Enterprise Linux ES (v. 2.1) Red Hat Enterprise Linux WS (v. 2.1) Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor
CVEs (cve.mitre.org):	CVE-2004-0381 CVE-2004-0388 CVE-2004-0457 CVE-2004-0835 CVE-2004-0836 CVE-2004-0837 CVE-2004-0957

Details

Updated mysql packages that fix various security issues, as well as a
number of bugs, are now available for Red Hat Enterprise Linux 2.1.

MySQL is a multi-user, multi-threaded SQL database server.

A number security issues that affect the mysql server have been reported:

Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked
the CREATE/INSERT rights of the old table instead of the new one. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect
function. In order to exploit this issue an attacker would need to force
the use of a malicious DNS server (CAN-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or
different) MERGE tables to change the UNION could cause the server to crash
or stall (CAN-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a
database with a name containing an underscore ("_"), the user also gains
the ability to grant privileges to other databases with similar names
(CAN-2004-0957).

Additionally, the following minor temporary file vulnerabilities were
discovered:

- Stan Bubroski and Shaun Colley found a temporary file vulnerability in
the mysqlbug script (CAN-2004-0381).
- A temporary file vulnerability was discovered in mysqld_multi
(CAN-2004-0388).
- Jeroen van Wolffelaar discovered an temporary file vulnerability in the
mysqlhotcopy script when using the scp method (CAN-2004-0457).

All users of mysql should upgrade to these updated packages, which resolve
these issues and also include fixes for a number of small bugs.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Updated packages

Red Hat Enterprise Linux AS (v. 2.1)

SRPMS:
mysql-3.23.58-1.72.1.src.rpm File outdated by: RHSA-2005:334	`MD5: 1a6ad34678d35aa5c1bfba0ff7290c44`

IA-32:
mysql-3.23.58-1.72.1.i386.rpm File outdated by: RHSA-2005:334	`MD5: a33c7efe12e0a4b0dade197a823a5e42`
mysql-devel-3.23.58-1.72.1.i386.rpm File outdated by: RHSA-2005:334	`MD5: 3b0621721b68c67f3d73681c9fbade09`
mysql-server-3.23.58-1.72.1.i386.rpm File outdated by: RHSA-2005:334	`MD5: 63280ad1d2b39d5865a209e2822cec5e`

IA-64:
mysql-3.23.58-1.72.1.ia64.rpm File outdated by: RHSA-2005:334	`MD5: 73b97bae08854a6bbd25a8ad0e057666`
mysql-devel-3.23.58-1.72.1.ia64.rpm File outdated by: RHSA-2005:334	`MD5: 709aff64529b31c9dc3ade3017509d44`
mysql-server-3.23.58-1.72.1.ia64.rpm File outdated by: RHSA-2005:334	`MD5: 311db47abcc5cc79b094804c5b3912f4`

Red Hat Enterprise Linux ES (v. 2.1)

SRPMS:
mysql-3.23.58-1.72.1.src.rpm File outdated by: RHSA-2005:334	`MD5: 1a6ad34678d35aa5c1bfba0ff7290c44`

IA-32:
mysql-3.23.58-1.72.1.i386.rpm File outdated by: RHSA-2005:334	`MD5: a33c7efe12e0a4b0dade197a823a5e42`
mysql-devel-3.23.58-1.72.1.i386.rpm File outdated by: RHSA-2005:334	`MD5: 3b0621721b68c67f3d73681c9fbade09`
mysql-server-3.23.58-1.72.1.i386.rpm File outdated by: RHSA-2005:334	`MD5: 63280ad1d2b39d5865a209e2822cec5e`

Red Hat Enterprise Linux WS (v. 2.1)

SRPMS:
mysql-3.23.58-1.72.1.src.rpm File outdated by: RHSA-2005:334	`MD5: 1a6ad34678d35aa5c1bfba0ff7290c44`

IA-32:
mysql-3.23.58-1.72.1.i386.rpm File outdated by: RHSA-2005:334	`MD5: a33c7efe12e0a4b0dade197a823a5e42`
mysql-devel-3.23.58-1.72.1.i386.rpm File outdated by: RHSA-2005:334	`MD5: 3b0621721b68c67f3d73681c9fbade09`
mysql-server-3.23.58-1.72.1.i386.rpm File outdated by: RHSA-2005:334	`MD5: 63280ad1d2b39d5865a209e2822cec5e`

Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor

SRPMS:
mysql-3.23.58-1.72.1.src.rpm File outdated by: RHSA-2005:334	`MD5: 1a6ad34678d35aa5c1bfba0ff7290c44`

IA-64:
mysql-3.23.58-1.72.1.ia64.rpm File outdated by: RHSA-2005:334	`MD5: 73b97bae08854a6bbd25a8ad0e057666`
mysql-devel-3.23.58-1.72.1.ia64.rpm File outdated by: RHSA-2005:334	`MD5: 709aff64529b31c9dc3ade3017509d44`
mysql-server-3.23.58-1.72.1.ia64.rpm File outdated by: RHSA-2005:334	`MD5: 311db47abcc5cc79b094804c5b3912f4`

Bugs fixed (see bugzilla for more information)

112693 - mysqlhotcopy of local Fedora DB broken after upgrade from RH9
113960 - [PATCH] Bug fix + enhancement for mysql_setpermission
115165 - botched string concat ?
124352 - Cannot drop databases
129409 - linking with 'mysql --libs' doesent seem to work correctly.
130348 - CAN-2004-0457 mysqlhotcopy insecure temporary file vulnerability
135372 - CAN-2004-0835 MySQL flaws (CAN-2004-0836, CAN-2004-0837, CAN-2004-0957)

References

https://www.redhat.com/security/data/cve/CVE-2004-0381.html
https://www.redhat.com/security/data/cve/CVE-2004-0388.html
https://www.redhat.com/security/data/cve/CVE-2004-0457.html
https://www.redhat.com/security/data/cve/CVE-2004-0835.html
https://www.redhat.com/security/data/cve/CVE-2004-0836.html
https://www.redhat.com/security/data/cve/CVE-2004-0837.html
https://www.redhat.com/security/data/cve/CVE-2004-0957.html

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package