An updated mysql-server package that fixes various security issues is now available in the Red Hat Enterprise Linux 3 Extras channel of Red Hat Network.

MySQL is a multi-user, multi-threaded SQL database server.

A number of security issues that affect the mysql-server package have been reported. Although Red Hat Enterprise Linux 3 does not ship with the mysql-server package, the affected package is available from the Red Hat Network Extras channel.

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Users of mysql-server should upgrade to these erratum packages, which correct these issues.

Several vulnerabilities have been discovered in MySQL, a popular database. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2004-0957     Sergei Golubchik discovered a problem in the access     handling for similar named databases. If a user is     granted privileges to a database with a name containing     an underscore ('_'), the user also gains privileges to     other databases with similar names.

  - CAN-2005-0709

    Stefano Di Paola discovered that MySQL allows remote     authenticated users with INSERT and DELETE privileges to     execute arbitrary code by using CREATE FUNCTION to     access libc calls.

  - CAN-2005-0710

    Stefano Di Paola discovered that MySQL allows remote     authenticated users with INSERT and DELETE privileges to     bypass library path restrictions and execute arbitrary     libraries by using INSERT INTO to modify the mysql.func     table.

  - CAN-2005-0711

    Stefano Di Paola discovered that MySQL uses predictable     file names when creating temporary tables, which allows     local users with CREATE TEMPORARY TABLE privileges to     overwrite arbitrary files via a symlink attack.

4.0.21 より古いバージョンの MySQL を実行しています。
このようなバージョンは、以下の 2 つの欠陥の影響を受ける可能性があります。

  - 許可されていないデータベース GRANT 権限の脆弱性があり、これによって攻撃者は、与えられている GRANT 権限を悪用して、他のデータベースに対してそれを使用できることがあります。（CVE-2004-0957）

  - サービス拒否の脆弱性は、FULLTEXT 検索機能の悪用によってトリガされることがあります。
    （CVE-2004-0956）

您正在运行的 MySQL 版本低于 4.0.21。
此类版本可能会受到两个缺陷的影响：

  - 存在未经授权的数据库 GRANT 特权漏洞，攻击者可利用此漏洞，滥用其获得的 GRANT 特权，并对其他数据库使用此特权。(CVE-2004-0957)

  - 存在拒绝服务漏洞，滥用 FULLTEXT 搜索功能可触发此漏洞。
    (CVE-2004-0956)

When a user is granted access to a database with a name containing an underscore and the underscore is not escaped then that user might also be able to access other, similarly named, databases on the affected system.

The problem is that the underscore is seen as a wildcard by MySQL and therefore it is possible that an admin might accidentally GRANT a user access to multiple databases.

Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1.

MySQL is a multi-user, multi-threaded SQL database server.

A number security issues that affect the mysql server have been reported :

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Additionally, the following minor temporary file vulnerabilities were discovered :

  - Stan Bubroski and Shaun Colley found a temporary file     vulnerability in the mysqlbug script (CVE-2004-0381). -     A temporary file vulnerability was discovered in     mysqld_multi (CVE-2004-0388). - Jeroen van Wolffelaar     discovered an temporary file vulnerability in the     mysqlhotcopy script when using the scp method     (CVE-2004-0457).

All users of mysql should upgrade to these updated packages, which resolve these issues and also include fixes for a number of small bugs.

USN-32-1 fixed a database privilege escalation vulnerability; original advisory text :

'If a user was granted privileges to a database with a name containing an underscore ('_'), the user also gained the ability to grant privileges to other databases with similar names. (CAN-2004-0957)'

Recently a corner case was discovered where this vulnerability can still be exploited, so another update is necessary.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

You are running a version of MySQL which is older than version 4.0.21.
Such versions are potentially affected by two flaws :

  - There is an unauthorized database GRANT privilege     vulnerability, which may allow an attacker to misuse the     GRANT privilege it has been given and to use it against     other databases. (CVE-2004-0957)

  - A denial of service vulnerability may be triggered by     the misuse of the FULLTEXT search functionality.
    (CVE-2004-0956)

您目前執行的 MySQL 版本比 4.0.21 舊。
這些版本可能受到兩個瑕疵的影響：

  - 一個是未經授權的資料庫 GRANT 權限弱點，可讓攻擊者濫用取得的 GRANT 權限，並用來對其他資料庫發動攻擊。(CVE-2004-0957)

  - 另一個是可以藉由濫用 FULLTEXT 搜尋功能觸發的拒絕服務弱點。
    (CVE-2004-0956)

Several vulnerabilities have been discovered in the MySQL database server.

Lukasz Wojtow discovered a potential buffer overflow in the function mysql_real_connect(). A malicious name server could send specially crafted DNS packages which might result in execution of arbitrary code with the database server's privileges. However, it is believed that this bug cannot be exploited with the C Standard library (glibc) that Ubuntu uses. (CAN-2004-0836).

Dean Ellis noticed a flaw that allows an authorized MySQL user to cause a denial of service (crash or hang) via concurrent execution of certain statements (ALTER TABLE ... UNION=, FLUSH TABLES) on tables of type MERGE (CAN-2004-0837)

Some query strings containing a double quote (like MATCH ... AGAINST (' some ' query' IN BOOLEAN MODE) ) that did not have a matching closing double quote caused a denial of service (server crash). Again, this is only exploitable by authorized mysql users. (CAN-2004-0956)

If a user was granted privileges to a database with a name containing an underscore ('_'), the user also gained the ability to grant privileges to other databases with similar names. (CAN-2004-0957).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in MySQL would allow a user with grant privileges to a database with a name containing an underscore character ('_') to have the ability to grant privileges to other databases with similar names.
This problem was previously discovered and fixed, but a new case where the problem still existed was recently discovered.

The updated packages have been patched to correct this issue.

The remote host is running a version of MySQL that is older than version 4.0.21.
It is vulnerable to a flaw that may allow an attacker to gain access to unauthorized databases. An attacker can exploit this vulnerability if he has GRANT privileges on databases containing '_'. 

The remote host is running a version of MySQL that is older than version 3.23.49 or than 4.0.20.  The version of the utility Mysqlhotcopy included in these versions of MySQL is reported to be prone to a vulnerability that may permit an attacker to overwrite arbitrary files on the database server with the privilege of the targeted user. Privilege escalation may also be possible. An attacker requires local interactive access in order to exploit this vulnerability. 

The remote host is running a version of MySQL that is older than version 4.0.21.
It is vulnerable to a flaw that may allow an attacker to gain access to unauthorized databases. An attacker can exploit this vulnerability if he has GRANT privileges on databases containing '_'.

The remote host is running a version of MySQL that is older than version 3.23.49 or than 4.0.20.  The version of the utility Mysqlhotcopy included in these versions of MySQL is reported to be prone to a vulnerability that may permit an attacker to overwrite arbitrary files on the database server with the privilege of the targeted user. Privilege escalation may also be possible. An attacker requires local interactive access in order to exploit this vulnerability.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
15631	RHEL 3 : mysql-server (RHSA-2004:611)	Nessus	Red Hat Local Security Checks	2004/11/4	2021/1/14	critical
18042	Debian DSA-707-1 : mysql - several vulnerabilities	Nessus	Debian Local Security Checks	2005/4/14	2021/1/4	medium
15477	MySQL < 4.0.21 の複数の脆弱性	Nessus	Databases	2004/10/17	2018/11/15	medium
15477	MySQL < 4.0.21 多种漏洞	Nessus	Databases	2004/10/17	2018/11/15	medium
18817	FreeBSD : mysql -- GRANT access restriction problem (01c231cd-4393-11d9-8bb9-00065be4b5b6)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	medium
15536	RHEL 2.1 : mysql (RHSA-2004:597)	Nessus	Red Hat Local Security Checks	2004/10/21	2021/1/14	critical
20495	Ubuntu 4.10 : mysql-dfsg vulnerability (USN-109-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	medium
15477	MySQL < 4.0.21 Multiple Vulnerabilities	Nessus	Databases	2004/10/17	2018/11/15	medium
15477	MySQL < 4.0.21 多種弱點	Nessus	Databases	2004/10/17	2018/11/15	medium
20648	Ubuntu 4.10 : mysql-dfsg vulnerabilities (USN-32-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	critical
18032	Mandrake Linux Security Advisory : MySQL (MDKSA-2005:070)	Nessus	Mandriva Local Security Checks	2005/4/13	2021/1/6	medium
2370	Oracle MySQL < 4.0.21 Remote GRANT Privilege Escalation	Nessus Network Monitor	Database	2004/10/28	2019/3/6	medium
2129	Oracle MySQL Mysqlhotcopy Script Insecure Temporary File Creation	Nessus Network Monitor	Database	2004/8/18	2019/3/6	high
801119	MySQL < 4.0.21 Remote GRANT Privilege Escalation	Log Correlation Engine	Database			medium
801162	MySQL Mysqlhotcopy Script Insecure Temporary File Creation	Log Correlation Engine	Database			medium

検出

プラグインの検索

critical

medium

medium

medium

medium

critical

medium

medium

medium

critical

medium

medium

high

medium

medium