Skip to navigation

Security Advisory Low: mysql security and bug fix update

Advisory: RHSA-2013:0121-1
Type: Security Advisory
Severity: Low
Issued on: 2013-01-08
Last updated on: 2013-01-08
Affected Products: RHEL Desktop Workstation (v. 5 client)
Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
CVEs (cve.mitre.org): CVE-2012-4452

Details

Updated mysql packages that fix one security issue and several bugs are now
available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

It was found that the fix for the CVE-2009-4030 issue, a flaw in the way
MySQL checked the paths used as arguments for the DATA DIRECTORY and INDEX
DIRECTORY directives when the "datadir" option was configured with a
relative path, was incorrectly removed when the mysql packages in Red Hat
Enterprise Linux 5 were updated to version 5.0.95 via RHSA-2012:0127. An
authenticated attacker could use this flaw to bypass the restriction
preventing the use of subdirectories of the MySQL data directory being used
as DATA DIRECTORY and INDEX DIRECTORY paths. This update re-applies the fix
for CVE-2009-4030. (CVE-2012-4452)

Note: If the use of the DATA DIRECTORY and INDEX DIRECTORY directives were
disabled as described in RHSA-2010:0109 (by adding "symbolic-links=0" to
the "[mysqld]" section of the "my.cnf" configuration file), users were not
vulnerable to this issue.

This issue was discovered by Karel Volný of the Red Hat Quality Engineering
team.

This update also fixes the following bugs:

* Prior to this update, the log file path in the logrotate script did not
behave as expected. As a consequence, the logrotate function failed to
rotate the "/var/log/mysqld.log" file. This update modifies the logrotate
script to allow rotating the mysqld.log file. (BZ#647223)

* Prior to this update, the mysqld daemon could fail when using the EXPLAIN
flag in prepared statement mode. This update modifies the underlying code
to handle the EXPLAIN flag as expected. (BZ#654000)

* Prior to this update, the mysqld init script could wrongly report that
mysql server startup failed when the server was actually started. This
update modifies the init script to report the status of the mysqld server
as expected. (BZ#703476)

* Prior to this update, the "--enable-profiling" option was by default
disabled. This update enables the profiling feature. (BZ#806365)

All MySQL users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. After installing this
update, the MySQL server daemon (mysqld) will be restarted automatically.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

RHEL Desktop Workstation (v. 5 client)

SRPMS:
mysql-5.0.95-3.el5.src.rpm
File outdated by:  RHSA-2013:0180
    MD5: 45d0d042a209a449307f92bd6be3a1b7
SHA-256: 31450ba2ad54d48ba895a563af02e9a5382faefbc5e0c1223ef47b084a0352d0
 
IA-32:
mysql-bench-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 7e6547c165cac42b32fb4e2036a70fb3
SHA-256: e85064fad4d23ea5c594d31d5f7b0187d5c9a1da7fbc5abe31795b498ecfc365
mysql-debuginfo-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 23ea6cd767770d5d88eabc5fe754b401
SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-devel-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 653f705455373e5f1d19ceabf4219629
SHA-256: 65ad5e18635d02550c791118775a55431a8ec01d0734db4fb9e003dcde77c5a1
mysql-server-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 20f7ad3edfe187b47e00d638bc123bba
SHA-256: 40a7b2d2c8cfc328040b30debd6d3b3cbd2a62aa4f431a605b954bfe7e84e8ac
mysql-test-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 9f73e50e526174de90433b4bc72df3e3
SHA-256: e2f050049849740a878474b8e0c17a9a27a5d981cf6a658595330d5bb0afaf21
 
x86_64:
mysql-bench-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 37f6285a2cd99848677776189fbdcc70
SHA-256: 7cfa7a53018ec90023f60ec48ca78e955986c30d227282dd4310e9df0a3e1820
mysql-debuginfo-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 23ea6cd767770d5d88eabc5fe754b401
SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 98ec2bae23fb453d64027a4154013ca1
SHA-256: 6d77fb84711d1c2be366a930eb2161319f2694013e884dd1ed5f21fb43d4f375
mysql-devel-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 653f705455373e5f1d19ceabf4219629
SHA-256: 65ad5e18635d02550c791118775a55431a8ec01d0734db4fb9e003dcde77c5a1
mysql-devel-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 427642c091142718e3ccc973d2708c4d
SHA-256: 3262f889dc0afbe0984aab1b6c5a6505cee1ba97870c929ef7fe6fe7f399b1c8
mysql-server-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 6a018963252194b70b420098f8286fe5
SHA-256: 3cf7e23d70d8b1645309d6637f3e84a2f0ffb665a2cb5cb77e258bb9829071ad
mysql-test-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: f5b79e47f01ede51fc0d8d0fe7fa4fd9
SHA-256: 8eda50bb7758aadafa16014736df13a726e7f2f91a89249caa2d8595fda3d0f9
 
Red Hat Enterprise Linux (v. 5 server)

SRPMS:
mysql-5.0.95-3.el5.src.rpm
File outdated by:  RHSA-2013:0180
    MD5: 45d0d042a209a449307f92bd6be3a1b7
SHA-256: 31450ba2ad54d48ba895a563af02e9a5382faefbc5e0c1223ef47b084a0352d0
 
IA-32:
mysql-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 4f0e30de4cd31ee6a5f5a7b4e2a8065c
SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-bench-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 7e6547c165cac42b32fb4e2036a70fb3
SHA-256: e85064fad4d23ea5c594d31d5f7b0187d5c9a1da7fbc5abe31795b498ecfc365
mysql-debuginfo-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 23ea6cd767770d5d88eabc5fe754b401
SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-devel-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 653f705455373e5f1d19ceabf4219629
SHA-256: 65ad5e18635d02550c791118775a55431a8ec01d0734db4fb9e003dcde77c5a1
mysql-server-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 20f7ad3edfe187b47e00d638bc123bba
SHA-256: 40a7b2d2c8cfc328040b30debd6d3b3cbd2a62aa4f431a605b954bfe7e84e8ac
mysql-test-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 9f73e50e526174de90433b4bc72df3e3
SHA-256: e2f050049849740a878474b8e0c17a9a27a5d981cf6a658595330d5bb0afaf21
 
IA-64:
mysql-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 4f0e30de4cd31ee6a5f5a7b4e2a8065c
SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-5.0.95-3.el5.ia64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 17a599122a9b9c5672e7e1ffe84aef89
SHA-256: 7667d91c4a84d4650af03802dfb5faaadc01e1bacd10c766975bfdd5204e7fb9
mysql-bench-5.0.95-3.el5.ia64.rpm
File outdated by:  RHSA-2013:0180
    MD5: c9b50fbe36d1c9d30c4442b96bfe31fa
SHA-256: f46360d90824a6f0ea308f42ecb1eb0b29c75311648c492f311412ef1de5af8a
mysql-debuginfo-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 23ea6cd767770d5d88eabc5fe754b401
SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.ia64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 3a42c153f7be56caee07a6aea6f682cf
SHA-256: 6f16263c831f0c62ade4c438a6b996c5868542b1bae5908c71f431a330b0104f
mysql-devel-5.0.95-3.el5.ia64.rpm
File outdated by:  RHSA-2013:0180
    MD5: db89650157347ce13df17ce6d9278377
SHA-256: df73406706451b035be3a2ca4df872d8037648f8ababdadbec79237623860547
mysql-server-5.0.95-3.el5.ia64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 6e688a87022ec146eb61e0879bc558c9
SHA-256: 669e2cf7044c685ecb6bdbb19b690010607ac1133ecf0333aa9805f15d0dcf11
mysql-test-5.0.95-3.el5.ia64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 7f5a433867441669b5e8bbfcec9d9b99
SHA-256: 5dd567d6b9162077ea34083bd810b6ed30d5cd686cbf33229c807494624e1495
 
PPC:
mysql-5.0.95-3.el5.ppc.rpm
File outdated by:  RHSA-2013:0180
    MD5: e28f6fb9e439010f98dc5611e07b0e51
SHA-256: 5721982ac5790c1239363f8487875d08a2da6e2ab572337a92e06c630b69e122
mysql-5.0.95-3.el5.ppc64.rpm
File outdated by:  RHSA-2013:0180
    MD5: ff985604f398ba2fcd00b8e81db2d07f
SHA-256: 583ccd69b2fab8106ef77f74ee0ac7005203efb8b9305d3ccee2a1eacb8f7a93
mysql-bench-5.0.95-3.el5.ppc.rpm
File outdated by:  RHSA-2013:0180
    MD5: c7656a70e547fbca478e0da8dcd4eab8
SHA-256: e1abb01d4eea0f37062535707e73837302030fa4412b61e80bf5fc8aecc9f83a
mysql-debuginfo-5.0.95-3.el5.ppc.rpm
File outdated by:  RHSA-2013:0180
    MD5: 29fbbc5f523478653c6f9fba7c421312
SHA-256: 7bc63aa34e479c48411e7d85fa5211c324fac9cd3bd40dd20355b808a048089f
mysql-debuginfo-5.0.95-3.el5.ppc64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 751b271ef1d7852c096c3627c1ed80ce
SHA-256: e5bb101df0bcb9fdfc7dd1a1581ca2122d9610d1646f85c53839c2fc23fc92fc
mysql-devel-5.0.95-3.el5.ppc.rpm
File outdated by:  RHSA-2013:0180
    MD5: 2ab026bf0bca9e5f0d5fc09f0db80474
SHA-256: 6a50e58de8e22929521cafd251b847619f846b6f321af97875696933144f3f09
mysql-devel-5.0.95-3.el5.ppc64.rpm
File outdated by:  RHSA-2013:0180
    MD5: f86e4528fa9bd9f7ad0d45d3b0bec689
SHA-256: 2f56d25ed03f2038fe4b0e5b7cb0bff1bc618c0196e816407c7d2d0703968d09
mysql-server-5.0.95-3.el5.ppc.rpm
File outdated by:  RHSA-2013:0180
    MD5: 4d3709fd480f4c2faa3c258f91b6e542
SHA-256: eb3e085e7ebfeb3c7f945d70ec1fde88905bf74bf502ca251aca4c66675c91bb
mysql-server-5.0.95-3.el5.ppc64.rpm
File outdated by:  RHSA-2013:0180
    MD5: d207d524a6e1af6dfcd3e542a4a7b3a6
SHA-256: b1c67b52e3fdabbad25afb8c6b4f3f347adf1be7e8e8d0b46bd1b091382c9eca
mysql-test-5.0.95-3.el5.ppc.rpm
File outdated by:  RHSA-2013:0180
    MD5: f1f69ead9ae0fd229e0945aee4b1c7ff
SHA-256: 0092ae04d65a3c084af9c1dc4e3792f9f78447c6aa1b431606aa272aa466cdb9
 
s390x:
mysql-5.0.95-3.el5.s390.rpm
File outdated by:  RHSA-2013:0180
    MD5: d9d9ea612258b17f3fb54699655272fd
SHA-256: 98d952412055eeed4f483c8abe7667cc84de08748a7d770661babbf945194796
mysql-5.0.95-3.el5.s390x.rpm
File outdated by:  RHSA-2013:0180
    MD5: 95795cd0998430c279aedaedb7520be5
SHA-256: 28b2bcf659f9106b0d3f823e548206b2629b618f5ea0dfd3c1b24762ea808d32
mysql-bench-5.0.95-3.el5.s390x.rpm
File outdated by:  RHSA-2013:0180
    MD5: cfc611a09970b86a2342343d282b2871
SHA-256: fe4f506a72d2e18cbc2fe6d3cd5c1c55a1d1ba7e83d939013c7421e132b7fb35
mysql-debuginfo-5.0.95-3.el5.s390.rpm
File outdated by:  RHSA-2013:0180
    MD5: 0aab6d2441e746dea2c7f32dc1b84baf
SHA-256: 7055e97bb3779dfe2624f8fd4ab717b617c336dbd7d2727a43e5c22848a495ea
mysql-debuginfo-5.0.95-3.el5.s390x.rpm
File outdated by:  RHSA-2013:0180
    MD5: a38576d5b4679e0c045a93196e2d77a7
SHA-256: f6438b866852dc6f6239b5fc2f08303b26a28f3100b25a41b0a80f0fdc60a44c
mysql-devel-5.0.95-3.el5.s390.rpm
File outdated by:  RHSA-2013:0180
    MD5: 638fff2f664a08cfc1a4413b18f6d39d
SHA-256: fd5b9a67bb8d7c3d44f939211b741334936d38bf78e00a30d427e4d04e11aaff
mysql-devel-5.0.95-3.el5.s390x.rpm
File outdated by:  RHSA-2013:0180
    MD5: 2204b24ce17303f66f4894a0655efe07
SHA-256: 6c5056b2f0e48add20c39517ea72c779e812579e05ec6d2bcc3525d720540b31
mysql-server-5.0.95-3.el5.s390x.rpm
File outdated by:  RHSA-2013:0180
    MD5: 307bbb5a4af09759de9b9e2311ad9111
SHA-256: a70f033ba63f8d60280d570f18e6ad82cd2d81444f3347177fa1d04152a6e433
mysql-test-5.0.95-3.el5.s390x.rpm
File outdated by:  RHSA-2013:0180
    MD5: 4355e2c1501da9af82a7bc981475ed61
SHA-256: 854780ee2c3d248d6cf7ea1806395c641704261c89762381c214eeeb4965c3ef
 
x86_64:
mysql-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 4f0e30de4cd31ee6a5f5a7b4e2a8065c
SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 44e5a715a340ea3636192167f3956f24
SHA-256: 8ff75d3f460a365e536a34fdca97f99cd80adb98ae396a0d3dce00508e455f0f
mysql-bench-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 37f6285a2cd99848677776189fbdcc70
SHA-256: 7cfa7a53018ec90023f60ec48ca78e955986c30d227282dd4310e9df0a3e1820
mysql-debuginfo-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 23ea6cd767770d5d88eabc5fe754b401
SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 98ec2bae23fb453d64027a4154013ca1
SHA-256: 6d77fb84711d1c2be366a930eb2161319f2694013e884dd1ed5f21fb43d4f375
mysql-devel-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 653f705455373e5f1d19ceabf4219629
SHA-256: 65ad5e18635d02550c791118775a55431a8ec01d0734db4fb9e003dcde77c5a1
mysql-devel-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 427642c091142718e3ccc973d2708c4d
SHA-256: 3262f889dc0afbe0984aab1b6c5a6505cee1ba97870c929ef7fe6fe7f399b1c8
mysql-server-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 6a018963252194b70b420098f8286fe5
SHA-256: 3cf7e23d70d8b1645309d6637f3e84a2f0ffb665a2cb5cb77e258bb9829071ad
mysql-test-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: f5b79e47f01ede51fc0d8d0fe7fa4fd9
SHA-256: 8eda50bb7758aadafa16014736df13a726e7f2f91a89249caa2d8595fda3d0f9
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
mysql-5.0.95-3.el5.src.rpm
File outdated by:  RHSA-2013:0180
    MD5: 45d0d042a209a449307f92bd6be3a1b7
SHA-256: 31450ba2ad54d48ba895a563af02e9a5382faefbc5e0c1223ef47b084a0352d0
 
IA-32:
mysql-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 4f0e30de4cd31ee6a5f5a7b4e2a8065c
SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-debuginfo-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 23ea6cd767770d5d88eabc5fe754b401
SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
 
x86_64:
mysql-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 4f0e30de4cd31ee6a5f5a7b4e2a8065c
SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 44e5a715a340ea3636192167f3956f24
SHA-256: 8ff75d3f460a365e536a34fdca97f99cd80adb98ae396a0d3dce00508e455f0f
mysql-debuginfo-5.0.95-3.el5.i386.rpm
File outdated by:  RHSA-2013:0180
    MD5: 23ea6cd767770d5d88eabc5fe754b401
SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.x86_64.rpm
File outdated by:  RHSA-2013:0180
    MD5: 98ec2bae23fb453d64027a4154013ca1
SHA-256: 6d77fb84711d1c2be366a930eb2161319f2694013e884dd1ed5f21fb43d4f375
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

526850 - MySQL 5.0.77 crashes on comparison of date & datetime types to NAME_CONST()
528512 - MySQL memory DoS
543730 - mysqld segfaults during SHOW CREATE TABLE
548685 - Extra characters appear in BLOB after mysqldump/import
654000 - Mysql bug 54488 - crash when using explain and prepared statements with subqueries
675906 - Restore / import of mysqldump fails on "Unknown command '\''"
806365 - mysql-server-5.0.95-1.el5_7.1 has Profiling disabled by default
860808 - CVE-2012-4452 mysql: regression of CVE-2009-4030


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/