[ MDKSA-2007:243 ] - Updated MySQL packages fix multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:243
http://www.mandriva.com/security/
_______________________________________________________________________
Package : MySQL
Date : December 10, 2007
Affected: 2007.0, 2007.1, 2008.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
A vulnerability in MySQL prior to 5.0.45 did not require priveliges
such as SELECT for the source table in a CREATE TABLE LIKE statement,
allowing remote authenticated users to obtain sensitive information
such as the table structure (CVE-2007-3781).
A vulnerability in the InnoDB engine in MySQL allowed remote
authenticated users to cause a denial of service (database crash)
via certain CONTAINS operations on an indexed column, which triggered
an assertion error (CVE-2007-5925).
Using RENAME TABLE against a table with explicit DATA DIRECTORY and
INDEX DIRECTORY options could be used to overwrite system table
information by replacing the file to which a symlink pointed to
(CVE-2007-5969).
The updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3781
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5925
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5969
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
ae48df2b0377d0f2ebb0aaaa7b6310c6
2007.0/i586/MySQL-5.0.24a-2.3mdv2007.0.i586.rpm
ecf691100caecf50b3643b6c254e0b1b
2007.0/i586/MySQL-Max-5.0.24a-2.3mdv2007.0.i586.rpm
8b6f53c1c9fa5f2150a8e7cc20b3a635
2007.0/i586/MySQL-bench-5.0.24a-2.3mdv2007.0.i586.rpm
bde8ba1841f68683a984cdea2405d40d
2007.0/i586/MySQL-client-5.0.24a-2.3mdv2007.0.i586.rpm
01dcc1472f5c013e80454458ca0bcdd5
2007.0/i586/MySQL-common-5.0.24a-2.3mdv2007.0.i586.rpm
d8ffbdd8f1e83dddc18ae1ab3da417ce
2007.0/i586/MySQL-ndb-extra-5.0.24a-2.3mdv2007.0.i586.rpm
836a595ac27e4e1bf9f0c554c625d8ee
2007.0/i586/MySQL-ndb-management-5.0.24a-2.3mdv2007.0.i586.rpm
a830470e23ab010c43165d89ee64d2b1
2007.0/i586/MySQL-ndb-storage-5.0.24a-2.3mdv2007.0.i586.rpm
89311e6a8ab90817d697100492d99695
2007.0/i586/MySQL-ndb-tools-5.0.24a-2.3mdv2007.0.i586.rpm
3cf781afa097fba7d0e80efe4e8c7316
2007.0/i586/libmysql15-5.0.24a-2.3mdv2007.0.i586.rpm
54c8da360b46bec71b1d6e165f29cd10
2007.0/i586/libmysql15-devel-5.0.24a-2.3mdv2007.0.i586.rpm
150e51cad7944bd0a079ce0fa04f4396
2007.0/i586/libmysql15-static-devel-5.0.24a-2.3mdv2007.0.i586.rpm
b26414bdd5720ef35f6f76bbb5822760
2007.0/SRPMS/MySQL-5.0.24a-2.3mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
dafabcfc5d4c8a72f122efeea6de49d6
2007.0/x86_64/MySQL-5.0.24a-2.3mdv2007.0.x86_64.rpm
9dd7a9ddedc86e0b7fc2a5c84f483c68
2007.0/x86_64/MySQL-Max-5.0.24a-2.3mdv2007.0.x86_64.rpm
1a63a771fb1019101771a7933488a335
2007.0/x86_64/MySQL-bench-5.0.24a-2.3mdv2007.0.x86_64.rpm
3d353e6abc9cdcd92391e1d42b667347
2007.0/x86_64/MySQL-client-5.0.24a-2.3mdv2007.0.x86_64.rpm
e34fe5b73b3747c786e1e170cf503b28
2007.0/x86_64/MySQL-common-5.0.24a-2.3mdv2007.0.x86_64.rpm
dea1a4166a873372a5580b96bbcb81ee
2007.0/x86_64/MySQL-ndb-extra-5.0.24a-2.3mdv2007.0.x86_64.rpm
86a9c04d129f88f3dfd9211a94fc0283
2007.0/x86_64/MySQL-ndb-management-5.0.24a-2.3mdv2007.0.x86_64.rpm
9f07fb9af772f3700af8d0655e6d4fc7
2007.0/x86_64/MySQL-ndb-storage-5.0.24a-2.3mdv2007.0.x86_64.rpm
160166e5ef2aa5614e6bbf97b40e83b0
2007.0/x86_64/MySQL-ndb-tools-5.0.24a-2.3mdv2007.0.x86_64.rpm
4437780704ec957046236da489097898
2007.0/x86_64/lib64mysql15-5.0.24a-2.3mdv2007.0.x86_64.rpm
e183be407214a07cf03bca7a9d48a003
2007.0/x86_64/lib64mysql15-devel-5.0.24a-2.3mdv2007.0.x86_64.rpm
924fe118e9b7d3195f98ec5488069087
2007.0/x86_64/lib64mysql15-static-devel-5.0.24a-2.3mdv2007.0.x86_64.rpm
b26414bdd5720ef35f6f76bbb5822760
2007.0/SRPMS/MySQL-5.0.24a-2.3mdv2007.0.src.rpm
Mandriva Linux 2007.1:
af618358834880d59c51efbb9114f44b
2007.1/i586/MySQL-5.0.37-2.3mdv2007.1.i586.rpm
bdf67dcabe1419c25be32e704ffc9118
2007.1/i586/MySQL-Max-5.0.37-2.3mdv2007.1.i586.rpm
a0e054eee6399ca0ac038ffdbf062b49
2007.1/i586/MySQL-bench-5.0.37-2.3mdv2007.1.i586.rpm
edc74fc3a9f85e0834ad8de6b5c7641a
2007.1/i586/MySQL-client-5.0.37-2.3mdv2007.1.i586.rpm
a05be3c7dbab742efc31c52174cb80f8
2007.1/i586/MySQL-common-5.0.37-2.3mdv2007.1.i586.rpm
110e07270766e269ea8c720c69ffea31
2007.1/i586/MySQL-ndb-extra-5.0.37-2.3mdv2007.1.i586.rpm
f97bc06af4f92fb1641ccc8c8c755925
2007.1/i586/MySQL-ndb-management-5.0.37-2.3mdv2007.1.i586.rpm
80061a23f4f385ea92ead26926a4f1bd
2007.1/i586/MySQL-ndb-storage-5.0.37-2.3mdv2007.1.i586.rpm
e7746d0fdaedc620600ca804217880be
2007.1/i586/MySQL-ndb-tools-5.0.37-2.3mdv2007.1.i586.rpm
341849b4e854eecee9bce112de3aabbf
2007.1/i586/libmysql15-5.0.37-2.3mdv2007.1.i586.rpm
f54ad215095b969d4eaa9387888ee382
2007.1/i586/libmysql15-devel-5.0.37-2.3mdv2007.1.i586.rpm
a8ccc5cd79afb825f07b800562eeb983
2007.1/i586/libmysql15-static-devel-5.0.37-2.3mdv2007.1.i586.rpm
c15830b94be90e125932c124277cb4e5
2007.1/SRPMS/MySQL-5.0.37-2.3mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
4114f7053c623903ae1052c87298104a
2007.1/x86_64/MySQL-5.0.37-2.3mdv2007.1.x86_64.rpm
6dc932e046c3acea306c2d73f974cd4d
2007.1/x86_64/MySQL-Max-5.0.37-2.3mdv2007.1.x86_64.rpm
af7084761155f1ae4ae4ffb38fd6f5d5
2007.1/x86_64/MySQL-bench-5.0.37-2.3mdv2007.1.x86_64.rpm
c9ac2de19761bec973a01587fa5e4771
2007.1/x86_64/MySQL-client-5.0.37-2.3mdv2007.1.x86_64.rpm
630177c360a7ccef549856b489c1cba9
2007.1/x86_64/MySQL-common-5.0.37-2.3mdv2007.1.x86_64.rpm
2e54c976e101b85d01b28b010a155117
2007.1/x86_64/MySQL-ndb-extra-5.0.37-2.3mdv2007.1.x86_64.rpm
19c236527f8d45b49a68081b61b198b9
2007.1/x86_64/MySQL-ndb-management-5.0.37-2.3mdv2007.1.x86_64.rpm
9621e6dbaa7414fcc509ca03c0c1b9fc
2007.1/x86_64/MySQL-ndb-storage-5.0.37-2.3mdv2007.1.x86_64.rpm
4ccced339bde031d32d68da7ecac9c62
2007.1/x86_64/MySQL-ndb-tools-5.0.37-2.3mdv2007.1.x86_64.rpm
e889ec496f2e3f49614f83972a387b88
2007.1/x86_64/lib64mysql15-5.0.37-2.3mdv2007.1.x86_64.rpm
e3d0231d99696ba1c6d17b7243cb0572
2007.1/x86_64/lib64mysql15-devel-5.0.37-2.3mdv2007.1.x86_64.rpm
7af0d505dd140cd2b93ed8df1ffda4c3
2007.1/x86_64/lib64mysql15-static-devel-5.0.37-2.3mdv2007.1.x86_64.rpm
c15830b94be90e125932c124277cb4e5
2007.1/SRPMS/MySQL-5.0.37-2.3mdv2007.1.src.rpm
Mandriva Linux 2008.0:
89cdb41e21ed18fc26ceed435aa7d93b
2008.0/i586/libmysql-devel-5.0.45-7.1mdv2008.0.i586.rpm
cba56cb02d635ad2f7836efa669a3e3a
2008.0/i586/libmysql-static-devel-5.0.45-7.1mdv2008.0.i586.rpm
ba1f720538f76334697746f9356467cf
2008.0/i586/libmysql15-5.0.45-7.1mdv2008.0.i586.rpm
95283adc79f2fe21611aa595f047ff22
2008.0/i586/mysql-5.0.45-7.1mdv2008.0.i586.rpm
53cc7abc631e7046e8510ad7bfcd9401
2008.0/i586/mysql-bench-5.0.45-7.1mdv2008.0.i586.rpm
7c625f140ce1a4ec8708424256ff75a2
2008.0/i586/mysql-client-5.0.45-7.1mdv2008.0.i586.rpm
81549bb1dc4d2ad0e328c67ea76245e5
2008.0/i586/mysql-common-5.0.45-7.1mdv2008.0.i586.rpm
71bf968ec0e8c0a8fac261605dff029c
2008.0/i586/mysql-max-5.0.45-7.1mdv2008.0.i586.rpm
8dcc6d09c69169e9a58dd44e39022364
2008.0/i586/mysql-ndb-extra-5.0.45-7.1mdv2008.0.i586.rpm
f1928ffbe77276098519f64c6f522e1a
2008.0/i586/mysql-ndb-management-5.0.45-7.1mdv2008.0.i586.rpm
0770146e29802dd26bacc6768f4e0202
2008.0/i586/mysql-ndb-storage-5.0.45-7.1mdv2008.0.i586.rpm
bc9325b67c64f9ba63d14d7eb582bd1a
2008.0/i586/mysql-ndb-tools-5.0.45-7.1mdv2008.0.i586.rpm
c0575884589bcd70be748a2ff39f19c1
2008.0/SRPMS/mysql-5.0.45-7.1mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
5adbf1a745ebe3c9d68600e6ae3cc90d
2008.0/x86_64/lib64mysql-devel-5.0.45-7.1mdv2008.0.x86_64.rpm
fcef4c2a7bf00d5939bd0a2512f05004
2008.0/x86_64/lib64mysql-static-devel-5.0.45-7.1mdv2008.0.x86_64.rpm
3ebea8d3fbedacb7a96195f1a49e0004
2008.0/x86_64/lib64mysql15-5.0.45-7.1mdv2008.0.x86_64.rpm
d08b3ec903dc8c804d573796a401ec64
2008.0/x86_64/mysql-5.0.45-7.1mdv2008.0.x86_64.rpm
b40014e51bf2e68b5dd67365ae099885
2008.0/x86_64/mysql-bench-5.0.45-7.1mdv2008.0.x86_64.rpm
faf05a4c4a684e63db58e2cfa779066c
2008.0/x86_64/mysql-client-5.0.45-7.1mdv2008.0.x86_64.rpm
d5d51b2fe6810193443e337cc063cc6f
2008.0/x86_64/mysql-common-5.0.45-7.1mdv2008.0.x86_64.rpm
36db213a8d356145f769c4764ecfdb43
2008.0/x86_64/mysql-max-5.0.45-7.1mdv2008.0.x86_64.rpm
3b7b4c4348a94687e6f70a077190578a
2008.0/x86_64/mysql-ndb-extra-5.0.45-7.1mdv2008.0.x86_64.rpm
6c6b4ac3e2e7f93ec4ae7736989a4865
2008.0/x86_64/mysql-ndb-management-5.0.45-7.1mdv2008.0.x86_64.rpm
ae26212b354d64f8c903dc771bc9d1b7
2008.0/x86_64/mysql-ndb-storage-5.0.45-7.1mdv2008.0.x86_64.rpm
ebd97d817a3c8c6d208712ad8fc5b788
2008.0/x86_64/mysql-ndb-tools-5.0.45-7.1mdv2008.0.x86_64.rpm
c0575884589bcd70be748a2ff39f19c1
2008.0/SRPMS/mysql-5.0.45-7.1mdv2008.0.src.rpm
Corporate 4.0:
e7d08c55508c5aff029bc712c3eaa985
corporate/4.0/i586/MySQL-5.0.24-1.3.20060mlcs4.i586.rpm
2929501ca876443313448190a76dd4b1
corporate/4.0/i586/MySQL-Max-5.0.24-1.3.20060mlcs4.i586.rpm
42ae6b36dd3fd0b655cdf853bcdac756
corporate/4.0/i586/MySQL-bench-5.0.24-1.3.20060mlcs4.i586.rpm
bf6c9a292ac3ceffe194b9515353bcf8
corporate/4.0/i586/MySQL-client-5.0.24-1.3.20060mlcs4.i586.rpm
423f7921eb3f13bce192b361115b63be
corporate/4.0/i586/MySQL-common-5.0.24-1.3.20060mlcs4.i586.rpm
b0ceab082e27ee7ec0463396cc3239a5
corporate/4.0/i586/MySQL-ndb-extra-5.0.24-1.3.20060mlcs4.i586.rpm
64e94e4df86309716ba11f28e7c06086
corporate/4.0/i586/MySQL-ndb-management-5.0.24-1.3.20060mlcs4.i586.rpm
68965d44922b0b7c6ccb58a939747c73
corporate/4.0/i586/MySQL-ndb-storage-5.0.24-1.3.20060mlcs4.i586.rpm
72dfe4a7c58ed1249cb096b9f0d661ca
corporate/4.0/i586/MySQL-ndb-tools-5.0.24-1.3.20060mlcs4.i586.rpm
f5da97c0283a559c161956371b92c1de
corporate/4.0/i586/libmysql15-5.0.24-1.3.20060mlcs4.i586.rpm
d835024b4814af69ca86c90a417b1ab5
corporate/4.0/i586/libmysql15-devel-5.0.24-1.3.20060mlcs4.i586.rpm
9c6c70427dfed5a57a13e5902a98022b
corporate/4.0/i586/libmysql15-static-devel-5.0.24-1.3.20060mlcs4.i586.rpm
399ce94ad408bddedab3d81288121625
corporate/4.0/SRPMS/MySQL-5.0.24-1.3.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
7e2d63d05b367f306249c9550208e118
corporate/4.0/x86_64/MySQL-5.0.24-1.3.20060mlcs4.x86_64.rpm
5173adbc8c5eab3d28c6b9e3ec43ff87
corporate/4.0/x86_64/MySQL-Max-5.0.24-1.3.20060mlcs4.x86_64.rpm
942043cc7038c2b67a5fc46ceb8f3103
corporate/4.0/x86_64/MySQL-bench-5.0.24-1.3.20060mlcs4.x86_64.rpm
b7e443185fd52a138e59db1b585892a4
corporate/4.0/x86_64/MySQL-client-5.0.24-1.3.20060mlcs4.x86_64.rpm
68b16b2a302efd03fe14393101e456b1
corporate/4.0/x86_64/MySQL-common-5.0.24-1.3.20060mlcs4.x86_64.rpm
8f29021b04eb3467ae0ffab4af5e7e93
corporate/4.0/x86_64/MySQL-ndb-extra-5.0.24-1.3.20060mlcs4.x86_64.rpm
ae0b10b13ea0dd9baef8c1a2a728ffde
corporate/4.0/x86_64/MySQL-ndb-management-5.0.24-1.3.20060mlcs4.x86_64.rpm
b21a2b8fc11c15b4106096f819b56997
corporate/4.0/x86_64/MySQL-ndb-storage-5.0.24-1.3.20060mlcs4.x86_64.rpm
3ed7adeec020550150264758f002a296
corporate/4.0/x86_64/MySQL-ndb-tools-5.0.24-1.3.20060mlcs4.x86_64.rpm
21aeb21a7295e6cadc89d9cdf5a917fa
corporate/4.0/x86_64/lib64mysql15-5.0.24-1.3.20060mlcs4.x86_64.rpm
bb9cfd0b7bf9dcadb498ec550b4e135c
corporate/4.0/x86_64/lib64mysql15-devel-5.0.24-1.3.20060mlcs4.x86_64.rpm
3b7daadd91dc22dbb16b5c2e9f16a11c
corporate/4.0/x86_64/lib64mysql15-static-devel-5.0.24-1.3.20060mlcs4.x86_64.rpm
399ce94ad408bddedab3d81288121625
corporate/4.0/SRPMS/MySQL-5.0.24-1.3.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFHXbndmqjQ0CJFipgRApC8AJ4i3TnENhYsdgeNsxRmcvjkzOCMxACg4W6r
84ksq8yvKbneUsb8qd4J6pw=
=YmKU
-----END PGP SIGNATURE-----