Skip to navigation

Security Advisory Updated MySQL packages fix various security issues

Advisory: RHSA-2002:288-22
Type: Security Advisory
Severity: N/A
Issued on: 2003-01-15
Last updated on: 2003-01-15
Affected Products: Red Hat Linux 7.0
Red Hat Linux 7.1
Red Hat Linux 7.2
Red Hat Linux 7.3
Red Hat Linux 8.0
CVEs (cve.mitre.org): CVE-2002-1373
CVE-2002-1374
CVE-2002-1375
CVE-2002-1376

Details

Updated MySQL packages are available for Red Hat Linux 7, 7.1, 7.2, 7.3,
and 8.0 which fix security vulnerabilities found in the MySQL server.

MySQL is a multi-user, multi-threaded SQL database server. While auditing
MySQL, Stefan Esser found security vulnerabilities that can be used to
crash the server or allow MySQL users to gain privileges.

A signed integer vulnerability in the COM_TABLE_DUMP package for MySQL
3.x to 3.23.53a allows remote attackers to cause a denial of service
(crash or hang) in mysqld by causing large negative integers to be provided
to a memcpy call. (CAN-2002-1373)

The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a and 4.x to
4.0.5a allows a remote attacker to gain privileges via a brute force
attack using a one-character password, which causes MySQL to only compare
the provided password against the first character of the real
password. (CAN-2002-1374)

The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a and 4.x to
4.0.5a allows remote attackers to execute arbitrary code via a long
response. (CAN-2002-1375)

The MySQL client library (libmysqlclient) in MySQL 3.x to 3.23.53a and 4.x
to 4.0.5a does not properly verify length fields for certain responses
in the read_rows or read_one_row routines, which allows a malicious server
to cause a denial of service and possibly execute arbitrary
code. (CAN-2002-1376)

Red Hat Linux 7, 7.1, 7.2, 7.3, and 8.0 contain versions of MySQL that
are vulnerable to these issues. All users of MySQL are advised to upgrade
to the erratum packages containing MySQL 3.23.54a which is not vulnerable
to these issues.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Updated packages

Red Hat Linux 7.0

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/mysql/3.23.54a-3.70/SRPMS/mysql-3.23.54a-3.70.src.rpm
Missing file
    MD5: 5dd77d69e22ed43e0ff28b29b8e44e92
ftp://updates.redhat.com/rhn/public/2703533/mysqlclient9/3.23.22-8/SRPMS/mysqlclient9-3.23.22-8.src.rpm
Missing file
    MD5: 9c782173b553a1998d317c2477ed3247
ftp://updates.redhat.com/rhn/repository/NULL/mysqlclient9/3.23.22-8/SRPMS/mysqlclient9-3.23.22-8.src.rpm
Missing file
    MD5: 9c782173b553a1998d317c2477ed3247
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/mysql/3.23.54a-3.70/i386/mysql-3.23.54a-3.70.i386.rpm
Missing file
    MD5: a06746956383b4f2d01728809225df64
ftp://updates.redhat.com/rhn/repository/NULL/mysql-devel/3.23.54a-3.70/i386/mysql-devel-3.23.54a-3.70.i386.rpm
Missing file
    MD5: f122e1fb596b8f35621549123e177720
ftp://updates.redhat.com/rhn/repository/NULL/mysql-server/3.23.54a-3.70/i386/mysql-server-3.23.54a-3.70.i386.rpm
Missing file
    MD5: 9b1c91cbd8b38f9964b06825e50931f9
ftp://updates.redhat.com/rhn/repository/NULL/mysqlclient9/3.23.22-8/i386/mysqlclient9-3.23.22-8.i386.rpm
Missing file
    MD5: 649000787148d19b8019919535845680
 
Red Hat Linux 7.1

SRPMS:
mysql-3.23.54a-3.71.src.rpm
File outdated by:  RHSA-2003:281
    MD5: e58fe98ddb3c8ac698ebc92ca8150b72
ftp://updates.redhat.com/rhn/public/2703533/mysqlclient9/3.23.22-8/SRPMS/mysqlclient9-3.23.22-8.src.rpm
Missing file
    MD5: 9c782173b553a1998d317c2477ed3247
ftp://updates.redhat.com/rhn/repository/NULL/mysqlclient9/3.23.22-8/SRPMS/mysqlclient9-3.23.22-8.src.rpm
Missing file
    MD5: 9c782173b553a1998d317c2477ed3247
 
IA-32:
mysql-3.23.54a-3.71.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: 240ec3da00638e7659af70c288aa04ba
mysql-devel-3.23.54a-3.71.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: a0b0060873f65a62e8f9a3e15aed64b6
mysql-server-3.23.54a-3.71.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: 01e625385fc064f3440ffc4c2b78f4b8
ftp://updates.redhat.com/rhn/repository/NULL/mysqlclient9/3.23.22-8/i386/mysqlclient9-3.23.22-8.i386.rpm
Missing file
    MD5: 649000787148d19b8019919535845680
 
Red Hat Linux 7.2

SRPMS:
mysql-3.23.54a-3.72.src.rpm
File outdated by:  RHSA-2003:281
    MD5: d18c6f59453525e47fdcc1575a1e8093
ftp://updates.redhat.com/rhn/public/2703533/mysqlclient9/3.23.22-8/SRPMS/mysqlclient9-3.23.22-8.src.rpm
Missing file
    MD5: 9c782173b553a1998d317c2477ed3247
ftp://updates.redhat.com/rhn/repository/NULL/mysqlclient9/3.23.22-8/SRPMS/mysqlclient9-3.23.22-8.src.rpm
Missing file
    MD5: 9c782173b553a1998d317c2477ed3247
 
IA-32:
mysql-3.23.54a-3.72.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: 8e5c91af905cda89d589162004f758c3
mysql-devel-3.23.54a-3.72.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: 516a9e98cd4574ee187f5ea5c1b42716
mysql-server-3.23.54a-3.72.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: 7feb019bec0fce4f0e7a39b5f4df6de3
ftp://updates.redhat.com/rhn/repository/NULL/mysqlclient9/3.23.22-8/i386/mysqlclient9-3.23.22-8.i386.rpm
Missing file
    MD5: 649000787148d19b8019919535845680
 
IA-64:
mysql-3.23.54a-3.72.ia64.rpm
File outdated by:  RHSA-2003:281
    MD5: 9587426ae471e596b8b3f90ef0b9ad3c
mysql-devel-3.23.54a-3.72.ia64.rpm
File outdated by:  RHSA-2003:281
    MD5: 7ffeed598fdc805f21f5adf3b01cc4eb
mysql-server-3.23.54a-3.72.ia64.rpm
File outdated by:  RHSA-2003:281
    MD5: 4e848cbb1ad6375638a55b20242df741
 
Red Hat Linux 7.3

SRPMS:
mysql-3.23.54a-3.73.src.rpm
File outdated by:  RHSA-2003:281
    MD5: 57f593d5fb5e21cff6ce65f934fe9dca
ftp://updates.redhat.com/rhn/public/2703533/mysqlclient9/3.23.22-8/SRPMS/mysqlclient9-3.23.22-8.src.rpm
Missing file
    MD5: 9c782173b553a1998d317c2477ed3247
ftp://updates.redhat.com/rhn/repository/NULL/mysqlclient9/3.23.22-8/SRPMS/mysqlclient9-3.23.22-8.src.rpm
Missing file
    MD5: 9c782173b553a1998d317c2477ed3247
 
IA-32:
mysql-3.23.54a-3.73.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: 0b39e3e5ee05d1daedb9e2146df24aaa
mysql-devel-3.23.54a-3.73.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: 1dd4afbca391e33250b2727b623123c8
mysql-server-3.23.54a-3.73.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: 62ade60f13d7d53eb7a791249688cfdb
ftp://updates.redhat.com/rhn/repository/NULL/mysqlclient9/3.23.22-8/i386/mysqlclient9-3.23.22-8.i386.rpm
Missing file
    MD5: 649000787148d19b8019919535845680
 
Red Hat Linux 8.0

SRPMS:
mysql-3.23.54a-4.src.rpm
File outdated by:  RHSA-2003:281
    MD5: bbfa3dec0f70825e7f8277c85db2296a
 
IA-32:
mysql-3.23.54a-4.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: e6aa4bfefb78db997f40ccb8e8815fcc
mysql-devel-3.23.54a-4.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: 8340813723029e6bca15cebce9a59c6f
mysql-server-3.23.54a-4.i386.rpm
File outdated by:  RHSA-2003:281
    MD5: 44c0dab242a5a26db0c139db6a371b02
 

Bugs fixed (see bugzilla for more information)

79606 - Several vulnerabilities within (lib)MySQL could allow (remote) compromise of client and/or server.


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/