[ MDVSA-2008:028 ] - Updated MySQL packages fix multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:028
http://www.mandriva.com/security/
_______________________________________________________________________
Package : mysql
Date : January 29, 2008
Affected: 2007.0, 2007.1, Corporate 4.0
_______________________________________________________________________
Problem Description:
The mysql_change_db() function in MySQL 5.0.x before 5.0.40 did not
restore THD::db_access privileges when returning from SQL SECURITY
INVOKER stored routines, which allowed remote authenticated users to
gain privileges (CVE-2007-2692).
The federated engine in MySQL 5.0.x, when performing a certain SHOW
TABLE STATUS query, did not properly handle a response with a small
number of columns, which could allow a remote MySQL server to cause
a denial of service (federated handler crash and daemon crash)
via a response that lacks the minimum required number of columns
(CVE-2007-6304).
The updated packages provide MySQL 5.0.45 for all Mandriva Linux
platforms that shipped with MySQL 5.0.x which offers a number of
feature enhancements and bug fixes. In addition, the updates for
Corporate Server 4.0 include support for the Sphinx engine.
Please note that due to the package name change (from 'MySQL' to
'mysql'), the mysqld service will not restart automatically so users
must execute 'service mysqld start' after the upgrade is complete.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2692
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6304
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
8308e15a835905cfb1db32eada26c883
2007.0/i586/libmysql-devel-5.0.45-8.1mdv2007.0.i586.rpm
497b43aa77224faa392c5141d48e138f
2007.0/i586/libmysql-static-devel-5.0.45-8.1mdv2007.0.i586.rpm
d46c0aea4b3d4e3b57f6d58cd508af57
2007.0/i586/libmysql15-5.0.45-8.1mdv2007.0.i586.rpm
3278969388161ffed75c14e15dd9d4ad
2007.0/i586/mysql-5.0.45-8.1mdv2007.0.i586.rpm
72961088740e022b2db2c7546f361c67
2007.0/i586/mysql-bench-5.0.45-8.1mdv2007.0.i586.rpm
36c92157cda26ce4297628e66c079d7f
2007.0/i586/mysql-client-5.0.45-8.1mdv2007.0.i586.rpm
773b61b83357a3946395135431cd32db
2007.0/i586/mysql-common-5.0.45-8.1mdv2007.0.i586.rpm
21b2a793207115ccf7f36c054b50b9fe
2007.0/i586/mysql-max-5.0.45-8.1mdv2007.0.i586.rpm
1d3bd0dcb8e675674ddda288c28cb558
2007.0/i586/mysql-ndb-extra-5.0.45-8.1mdv2007.0.i586.rpm
3db8afbca3dd5827ffedc4e47c10f97e
2007.0/i586/mysql-ndb-management-5.0.45-8.1mdv2007.0.i586.rpm
a6a279e76cca9cdf3ac5565179e80545
2007.0/i586/mysql-ndb-storage-5.0.45-8.1mdv2007.0.i586.rpm
f8b9a30a32e247915b9858f3b7f63379
2007.0/i586/mysql-ndb-tools-5.0.45-8.1mdv2007.0.i586.rpm
e64751b034f8560d5118b35e6a5092fb
2007.0/SRPMS/mysql-5.0.45-8.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
cf40fcf35654f9c2c178f8536f718f72
2007.0/x86_64/lib64mysql-devel-5.0.45-8.1mdv2007.0.x86_64.rpm
75c959ef8c66d26b24b32a79e9cc28bd
2007.0/x86_64/lib64mysql-static-devel-5.0.45-8.1mdv2007.0.x86_64.rpm
cdfe8b2ea0baec8d6574a13ddcb8e39b
2007.0/x86_64/lib64mysql15-5.0.45-8.1mdv2007.0.x86_64.rpm
7b55f3b2c08793911edb7aa0e1cc4b4d
2007.0/x86_64/mysql-5.0.45-8.1mdv2007.0.x86_64.rpm
6c8a12a0b9a17dc9ba2f91b69de366a3
2007.0/x86_64/mysql-bench-5.0.45-8.1mdv2007.0.x86_64.rpm
cc3b0305b62d265bf4ea28de45c409a4
2007.0/x86_64/mysql-client-5.0.45-8.1mdv2007.0.x86_64.rpm
6eed047db759509c10eb349b6c2546df
2007.0/x86_64/mysql-common-5.0.45-8.1mdv2007.0.x86_64.rpm
a4527d7bb167064a0028cf3f9b768dc5
2007.0/x86_64/mysql-max-5.0.45-8.1mdv2007.0.x86_64.rpm
f06ce459897d0e0c93a301c2312a53e9
2007.0/x86_64/mysql-ndb-extra-5.0.45-8.1mdv2007.0.x86_64.rpm
937776dc1bad2a792d33184b92e9bb56
2007.0/x86_64/mysql-ndb-management-5.0.45-8.1mdv2007.0.x86_64.rpm
df971f898499ec07b86d70ca40c12567
2007.0/x86_64/mysql-ndb-storage-5.0.45-8.1mdv2007.0.x86_64.rpm
aa08021ec8da55ace45677a0c2df1d81
2007.0/x86_64/mysql-ndb-tools-5.0.45-8.1mdv2007.0.x86_64.rpm
e64751b034f8560d5118b35e6a5092fb
2007.0/SRPMS/mysql-5.0.45-8.1mdv2007.0.src.rpm
Mandriva Linux 2007.1:
a38836b0cbc846c1dd00e6d585a5a294
2007.1/i586/libmysql-devel-5.0.45-8.1mdv2007.1.i586.rpm
2b7b67b466378773aceaba6ef463bf5c
2007.1/i586/libmysql-static-devel-5.0.45-8.1mdv2007.1.i586.rpm
ce17d4f08128e4ee6fe65c0f9714d977
2007.1/i586/libmysql15-5.0.45-8.1mdv2007.1.i586.rpm
e379f1928765efaeba54e955d814e319
2007.1/i586/mysql-5.0.45-8.1mdv2007.1.i586.rpm
0b193494a536b74a26481c52b81b5ddb
2007.1/i586/mysql-bench-5.0.45-8.1mdv2007.1.i586.rpm
2eabad8947dd72625bce27a7080352d8
2007.1/i586/mysql-client-5.0.45-8.1mdv2007.1.i586.rpm
3a44bdf485a76168b8e34d5c9d32b7b6
2007.1/i586/mysql-common-5.0.45-8.1mdv2007.1.i586.rpm
a89063f71cb71697814d722d4db74681
2007.1/i586/mysql-max-5.0.45-8.1mdv2007.1.i586.rpm
dfba29fc3bc045ba88951f3f9de4aff2
2007.1/i586/mysql-ndb-extra-5.0.45-8.1mdv2007.1.i586.rpm
e8c6e2cf09c6455d744063f0263d6b21
2007.1/i586/mysql-ndb-management-5.0.45-8.1mdv2007.1.i586.rpm
cc7b6344cd4fffa8445f39ba1b346ca9
2007.1/i586/mysql-ndb-storage-5.0.45-8.1mdv2007.1.i586.rpm
467865cd19dd0490f786ee23ab54e065
2007.1/i586/mysql-ndb-tools-5.0.45-8.1mdv2007.1.i586.rpm
a9b3d46326af15bfd46be2c83686777f
2007.1/SRPMS/mysql-5.0.45-8.1mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
7b08c92ffd78f132aafba21ab594a42d
2007.1/x86_64/lib64mysql-devel-5.0.45-8.1mdv2007.1.x86_64.rpm
da3d05a494925b934e0456162b006888
2007.1/x86_64/lib64mysql-static-devel-5.0.45-8.1mdv2007.1.x86_64.rpm
53d391471cc83b3d85db9b2bfc788494
2007.1/x86_64/lib64mysql15-5.0.45-8.1mdv2007.1.x86_64.rpm
308068c6d03d3d5abbd0b444e836cc17
2007.1/x86_64/mysql-5.0.45-8.1mdv2007.1.x86_64.rpm
04e3fb67f3f67a8747b1d2bf53b5e547
2007.1/x86_64/mysql-bench-5.0.45-8.1mdv2007.1.x86_64.rpm
851d191e569b72a5b7624b2a32e4e584
2007.1/x86_64/mysql-client-5.0.45-8.1mdv2007.1.x86_64.rpm
12fc2e3d907bfa04cb02496146cc4a56
2007.1/x86_64/mysql-common-5.0.45-8.1mdv2007.1.x86_64.rpm
16d00cebde97ee6be2742f81937d5915
2007.1/x86_64/mysql-max-5.0.45-8.1mdv2007.1.x86_64.rpm
06f1a09c1a8c5e721565b4e39390e184
2007.1/x86_64/mysql-ndb-extra-5.0.45-8.1mdv2007.1.x86_64.rpm
ac18d6bb01af8d50311d8a12090d8391
2007.1/x86_64/mysql-ndb-management-5.0.45-8.1mdv2007.1.x86_64.rpm
33f135b18c515ddcbc3a7cef106dfd82
2007.1/x86_64/mysql-ndb-storage-5.0.45-8.1mdv2007.1.x86_64.rpm
b543874252fd45641001a68523e3cb76
2007.1/x86_64/mysql-ndb-tools-5.0.45-8.1mdv2007.1.x86_64.rpm
a9b3d46326af15bfd46be2c83686777f
2007.1/SRPMS/mysql-5.0.45-8.1mdv2007.1.src.rpm
Corporate 4.0:
10b08c4aef587ab1009b30a7f6786267
corporate/4.0/i586/libmysql-devel-5.0.45-7.1.20060mlcs4.i586.rpm
5224612a804fba33a616f2e8eeb2fb66
corporate/4.0/i586/libmysql-static-devel-5.0.45-7.1.20060mlcs4.i586.rpm
c3ba2b6e48f6ac91416e296ed2e48ccd
corporate/4.0/i586/libmysql15-5.0.45-7.1.20060mlcs4.i586.rpm
a0d41fd603cadfb613fab192a9f57d8b
corporate/4.0/i586/mysql-5.0.45-7.1.20060mlcs4.i586.rpm
7ad5cd1d76be29f206148756d7675466
corporate/4.0/i586/mysql-bench-5.0.45-7.1.20060mlcs4.i586.rpm
33194b388687a13e43ff6d464e058ff5
corporate/4.0/i586/mysql-client-5.0.45-7.1.20060mlcs4.i586.rpm
e95b67383618e7e903d59fa035489a38
corporate/4.0/i586/mysql-common-5.0.45-7.1.20060mlcs4.i586.rpm
465aa5b928645beff8c33da0b2a7404e
corporate/4.0/i586/mysql-max-5.0.45-7.1.20060mlcs4.i586.rpm
c5c71f0d9423b930bc1da328e24205d5
corporate/4.0/i586/mysql-ndb-extra-5.0.45-7.1.20060mlcs4.i586.rpm
b33302b1b3376dd5cb5f3f294e83bef6
corporate/4.0/i586/mysql-ndb-management-5.0.45-7.1.20060mlcs4.i586.rpm
039351fc45003c4b3e21f6664cca8912
corporate/4.0/i586/mysql-ndb-storage-5.0.45-7.1.20060mlcs4.i586.rpm
56931d13e6b2bb73cd40bbe148e96e9a
corporate/4.0/i586/mysql-ndb-tools-5.0.45-7.1.20060mlcs4.i586.rpm
041dd79dc8f4531524ea7c11386c1eaa
corporate/4.0/SRPMS/mysql-5.0.45-7.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
8d35642f0a5ff7f8cc917751a4d52e6a
corporate/4.0/x86_64/lib64mysql-devel-5.0.45-7.1.20060mlcs4.x86_64.rpm
2d908a9332638c14dd31e8d77113a9da
corporate/4.0/x86_64/lib64mysql-static-devel-5.0.45-7.1.20060mlcs4.x86_64.rpm
bf3443b40917fd9f8cf872b7f0731164
corporate/4.0/x86_64/lib64mysql15-5.0.45-7.1.20060mlcs4.x86_64.rpm
070736f9c11739b1636d81244412057f
corporate/4.0/x86_64/mysql-5.0.45-7.1.20060mlcs4.x86_64.rpm
cefe0f1bbc72355ce777f296b45b5ed3
corporate/4.0/x86_64/mysql-bench-5.0.45-7.1.20060mlcs4.x86_64.rpm
57e0592185510613cd47c1bafe835f47
corporate/4.0/x86_64/mysql-client-5.0.45-7.1.20060mlcs4.x86_64.rpm
7588a705de13a66d52f1a917251d6b71
corporate/4.0/x86_64/mysql-common-5.0.45-7.1.20060mlcs4.x86_64.rpm
24f33b4a948e3187d409c923c574201e
corporate/4.0/x86_64/mysql-max-5.0.45-7.1.20060mlcs4.x86_64.rpm
00c7d7b67e7ad5428571cfe34472aefb
corporate/4.0/x86_64/mysql-ndb-extra-5.0.45-7.1.20060mlcs4.x86_64.rpm
994c10d3df42ad91db095ed3455bed75
corporate/4.0/x86_64/mysql-ndb-management-5.0.45-7.1.20060mlcs4.x86_64.rpm
74ec034893fbbc0db4eecd62748f19ab
corporate/4.0/x86_64/mysql-ndb-storage-5.0.45-7.1.20060mlcs4.x86_64.rpm
d29e8aad80d5ad6bedbcca512700e7d1
corporate/4.0/x86_64/mysql-ndb-tools-5.0.45-7.1.20060mlcs4.x86_64.rpm
041dd79dc8f4531524ea7c11386c1eaa
corporate/4.0/SRPMS/mysql-5.0.45-7.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
iD8DBQFHn8bhmqjQ0CJFipgRAmC2AJ9eX48lecJkUaKkXnRAWKIwgmeD8gCgmXjp
4mhVLb87csMrDvR176pf7GI=
=A9gT
-----END PGP SIGNATURE-----