Updated mysql packages that fix various temporary file security issues, as well as a number of bugs, are now available.

MySQL is a multi-user, multi-threaded SQL database server.

This update fixes a number of small bugs, including some potential security problems associated with careless handling of temporary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0381, CVE-2004-0388, and CVE-2004-0457 to these issues.

A number of additional security issues that affect mysql have been corrected in the source package. These include CVE-2004-0835, CVE-2004-0836, CVE-2004-0837, and CVE-2004-0957. Red Hat Enterprise Linux 3 does not ship with the mysql-server package and is therefore not affected by these issues.

This update also allows 32-bit and 64-bit libraries to be installed concurrently on the same system.

All users of mysql should upgrade to these updated packages, which resolve these issues.

4.0.21 より古いバージョンの MySQL を実行しています。

mysqlhotcopy には、報告されているところによれば、安全でない一時ファイル作成の脆弱性が含まれています。その結果、アプリケーションによって作成される一時ファイルが予測可能なファイル名を使用することがあります。 

ローカル攻撃者は、潜在的にこの脆弱性を悪用して、シンボリックリンクファイルの上書き攻撃を実行することがあります。 

*** 注 : この脆弱性はローカルのみです

The remote host is affected by the vulnerability described in GLSA-200409-02 (MySQL: Insecure temporary file creation in mysqlhotcopy)

    Jeroen van Wolffelaar discovered that the MySQL database hot copy utility     (mysqlhotcopy.sh), when using the scp method, uses temporary files with     predictable names. A malicious local user with write access to the /tmp     directory could create a symbolic link pointing to a file, which may then     be overwritten. In cases where mysqlhotcopy is run as root, a malicious     user could create a symlink to a critical file such as /etc/passwd and     cause it to be overwritten.
  Impact :

    A local attacker could use this vulnerability to destroy other users' data     or corrupt and destroy system files, possibly leading to a denial of     service condition.
  Workaround :

    There is no known workaround at this time.

您正在运行的 MySQL 版本低于 4.0.21。

有报告称 Mysqlhotcopy 包含不安全的临时文件创建漏洞。此漏洞的后果是由应用程序创建的临时文件可能使用可预测的文件名。 

本地攻击者可能会利用此漏洞执行符号链接文件覆盖攻击。 

*** 注意：此漏洞仅本地存在

您目前執行的 MySQL 版本比 4.0.21 舊。

報告指出 Mysqlhotcopy 含有不安全的暫存檔建立弱點。這會導致應用程式建立的暫存檔可能使用可預測的檔案名稱。 

本機攻擊者可能會利用此弱點執行符號連結檔案覆寫攻擊。 

*** 注意：此弱點僅影響本機

Jeroen van Wolffelaar discovered an insecure temporary file vulnerability in the mysqlhotcopy script when using the scp method which is part of the mysql-server package.

A number of problems have been discovered in the MySQL database server :

Jeroen van Wolffelaar discovered an insecure temporary file vulnerability in the mysqlhotcopy script when using the scp method (CVE-2004-0457).

Oleksandr Byelkin discovered that the 'ALTER TABLE ... RENAME' would check the CREATE/INSERT rights of the old table rather than the new one (CVE-2004-0835).

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION can cause the server to crash or stall (CVE-2004-0837).

The updated MySQL packages have been patched to protect against these issues.

According to Christian Hammers :

[mysqlhotcopy created] temporary files in /tmp which had predictable filenames and such could be used for a tempfile run attack.

Jeroen van Wolffelaar is credited with discovering the issue.

You are running a version of MySQL which is older than version 4.0.21.

Mysqlhotcopy is reported to contain an insecure temporary file creation vulnerability. The result of this is that temporary files created by the application may use predictable filenames. 

A local attacker could potentially exploit this vulnerability to execute symbolic link file overwrite attacks. 

*** Note : this vulnerability is local only

Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1.

MySQL is a multi-user, multi-threaded SQL database server.

A number security issues that affect the mysql server have been reported :

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Additionally, the following minor temporary file vulnerabilities were discovered :

  - Stan Bubroski and Shaun Colley found a temporary file     vulnerability in the mysqlbug script (CVE-2004-0381). -     A temporary file vulnerability was discovered in     mysqld_multi (CVE-2004-0388). - Jeroen van Wolffelaar     discovered an temporary file vulnerability in the     mysqlhotcopy script when using the scp method     (CVE-2004-0457).

All users of mysql should upgrade to these updated packages, which resolve these issues and also include fixes for a number of small bugs.

The remote host is running a version of MySQL that is older than version 3.23.49 or than 4.0.20.  The version of the utility Mysqlhotcopy included in these versions of MySQL is reported to be prone to a vulnerability that may permit an attacker to overwrite arbitrary files on the database server with the privilege of the targeted user. Privilege escalation may also be possible. An attacker requires local interactive access in order to exploit this vulnerability. 

ID	名前	製品	ファミリー	公開日	更新日	深刻度
15534	RHEL 3 : mysql (RHSA-2004:569)	Nessus	Red Hat Local Security Checks	2004/10/21	2021/1/14	medium
14343	MySQL < 4.0.21 mysqlhotcopy の不安全な一時ファイル作成	Nessus	Databases	2004/8/23	2018/7/16	medium
14649	GLSA-200409-02 : MySQL: Insecure temporary file creation in mysqlhotcopy	Nessus	Gentoo Local Security Checks	2004/9/3	2021/1/6	medium
14343	MySQL < 4.0.21 mysqlhotcopy 不安全的临时文件创建	Nessus	Databases	2004/8/23	2018/7/16	medium
14343	MySQL < 4.0.21 mysqlhotcopy 不安全的暫存檔建立	Nessus	Databases	2004/8/23	2018/7/16	medium
15377	Debian DSA-540-1 : mysql - insecure file creation	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	medium
15599	Mandrake Linux Security Advisory : MySQL (MDKSA-2004:119)	Nessus	Mandriva Local Security Checks	2004/11/2	2021/1/6	critical
37724	FreeBSD : mysql -- mysqlhotcopy insecure temporary file creation (0c4d5973-f2ab-11d8-9837-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	2009/4/23	2021/1/6	medium
14343	MySQL < 4.0.21 mysqlhotcopy Insecure Temporary File Creation	Nessus	Databases	2004/8/23	2018/7/16	medium
15536	RHEL 2.1 : mysql (RHSA-2004:597)	Nessus	Red Hat Local Security Checks	2004/10/21	2021/1/14	critical
2129	Oracle MySQL Mysqlhotcopy Script Insecure Temporary File Creation	Nessus Network Monitor	Database	2004/8/18	2019/3/6	high
801162	MySQL Mysqlhotcopy Script Insecure Temporary File Creation	Log Correlation Engine	Database			medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

critical

medium

medium

critical

high

medium