A stack-based buffer overflow in the init_syms function of MySQL, a popular database, has been discovered that allows remote authenticated users who can create user-defined functions to execute arbitrary code via a long function_name field. The ability to create user-defined functions is not typically granted to untrusted users.

The following vulnerability matrix shows which version of MySQL in which distribution has this problem fixed :

                   woody            sarge            sid                mysql            3.23.49-8.14     n/a              n/a                mysql-dfsg       n/a              4.0.24-10sarge1  4.0.24-10sarge1    mysql-dfsg-4.1   n/a              4.1.11a-4sarge2  4.1.14-2           mysql-dfsg-5.0   n/a              n/a              5.0.11beta-3

AppSecInc Team SHATTER discovered a buffer overflow in the 'CREATE FUNCTION' statement. By specifying a specially crafted long function name, a local or remote attacker with function creation privileges could crash the server or execute arbitrary code with server privileges.

However, the right to create function is usually not granted to untrusted users.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-180-1 fixed a vulnerability in the mysql-server package (which ships version 4.0). Version 4.1 is vulnerable against the same flaw.

Please note that this package is not officially supported in Ubuntu 5.10.

Origial advisory :

'AppSecInc Team SHATTER discovered a buffer overflow in the 'CREATE FUNCTION' statement. By specifying a specially crafted long function name, a local or remote attacker with function creation privileges could crash the server or execute arbitrary code with server privileges.

However, the right to create function is usually not granted to untrusted users.'.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A stack-based buffer overflow was discovered in the init_syms function in MySQL that allows authenticated users that can create user-defined functions to execute arbitrary code via a long function_name field.

The updated packages have been patched to address these issues.

バージョン番号によっては、リモートホストへのMySQLのインストールは、2つの欠陥の影響を受ける可能性があります。

  - ユーザー定義関数の名前をスタックベースのバッファにコピーする際に、バッファオーバーフローが発生する可能性があります。ユーザー定義関数を作成するための十分なアクセス権がある場合、攻撃者がこれを悪用し、影響を受けるデータベースサーバープロセスのコンテキスト内で任意のコードを実行する可能性があります（CVE-2005-2558）。

  - mysql_create_functionは、ディレクトリトラバーサル攻撃に対して完全には保護されていません。Windowsでは、バックスラッシュ文字を使用することで、任意のファイルを含めることができます（CVE-2005-2573）。

根據其版本號碼來判斷，遠端主機上安裝的 MySQL 可能受到兩個瑕疵影響：

  - 將使用者定義的函式名稱複製到堆疊型緩衝區時，可觸發緩衝區溢位弱點。攻擊者若有足夠的權限建立由使用者定義的函式，便可能利用此弱點，並在受影響資料庫伺服器處理程序的內容中執行任意程式碼。(CVE-2005-2558)

  - mysql_create_function 未受到針對目錄遊走攻擊的全面保護。在 Windows 上，可以使用反斜線字元來包含任意檔案。(CVE-2005-2573)

根据其版本号，远程主机上安装的 MySQL 可能会受到两个缺陷的影响：

  - 将用户定义的函数名称复制到基于堆栈的缓冲区时，可能会触发缓冲区溢出漏洞。如果拥有创建用户定义函数的足够权限，攻击者可能会利用此漏洞，并在受影响数据库服务器进程环境中执行任意代码。(CVE-2005-2558)

  - mysql_create_function 无法全方位防范目录遍历攻击。在 Windows 上，可以使用反斜线字符包含任意文件。(CVE-2005-2573)

According to its version number, the installation of MySQL on the remote host is potentially affected by two flaws :

  - A buffer overflow can be triggered when copying the name of a     user-defined function into a stack-based buffer. With     sufficient access to create a user-defined function, an     attacker may be able to exploit this and execute arbitrary     code within the context of the affected database server     process. (CVE-2005-2558)

  - The mysql_create_function is not fully protected against     directory traversal attacks. On Windows, arbitrary files can     be included by using backslash characters. (CVE-2005-2573)

This update only covers binary packages for the big endian MIPS architecture that was mysteriously forgotten in the earlier update.
For completeness below is the original advisory text :

  A stack-based buffer overflow in the init_syms function of MySQL, a   popular database, has been discovered that allows remote   authenticated users who can create user-defined functions to execute   arbitrary code via a long function_name field. The ability to create   user-defined functions is not typically granted to untrusted users.

The following vulnerability matrix explains which version of MySQL in which distribution has this problem fixed :

                   woody            sarge            sid                mysql            3.23.49-8.14     n/a              n/a                mysql-dfsg       n/a              4.0.24-10sarge1  4.0.24-10sarge1    mysql-dfsg-4.1   n/a              4.1.11a-4sarge2  4.1.14-2           mysql-dfsg-5.0   n/a              n/a              5.0.11beta-3

According to its version number, the installation of MySQL on the remote host may be prone to a buffer overflow when copying the name of a user-defined function into a stack-based buffer.  With sufficient access to create a user-defined function, an attacker may be able to exploit this and execute arbitrary code within the context of the affected database server process. 

ID	名前	製品	ファミリー	公開日	更新日	深刻度
19798	Debian DSA-829-1 : mysql - buffer overflow	Nessus	Debian Local Security Checks	2005/10/5	2021/1/4	medium
20591	Ubuntu 4.10 / 5.04 : mysql-dfsg vulnerability (USN-180-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	medium
20760	Ubuntu 5.10 : mysql-dfsg-4.1 vulnerability (USN-180-2)	Nessus	Ubuntu Local Security Checks	2006/1/21	2021/1/19	medium
19918	Mandrake Linux Security Advisory : MySQL (MDKSA-2005:163)	Nessus	Mandriva Local Security Checks	2005/10/5	2021/1/6	medium
19416	MySQL < 4.0.25 / 4.1.13 / 5.0.7の複数の脆弱性	Nessus	Databases	2005/8/10	2018/11/15	medium
19416	MySQL < 4.0.25 / 4.1.13 / 5.0.7 多個弱點	Nessus	Databases	2005/8/10	2018/11/15	medium
19416	MySQL < 4.0.25 / 4.1.13 / 5.0.7 多个漏洞	Nessus	Databases	2005/8/10	2018/11/15	medium
19416	MySQL < 4.0.25 / 4.1.13 / 5.0.7 Multiple Vulnerabilies	Nessus	Databases	2005/8/10	2018/11/15	medium
19800	Debian DSA-831-1 : mysql-dfsg - buffer overflow	Nessus	Debian Local Security Checks	2005/10/5	2021/1/4	medium
19802	Debian DSA-833-2 : mysql-dfsg-4.1 - buffer overflow	Nessus	Debian Local Security Checks	2005/10/5	2021/1/4	medium
3158	Oracle MySQL User-Defined Function init_syms() Overflow	Nessus Network Monitor	Database	2005/8/9	2019/3/6	medium
801121	MySQL User-Defined Function init_syms() Overflow	Log Correlation Engine	Database			medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium