[USN-528-1] MySQL vulnerabilities

Kees Cook kees at ubuntu.com
Thu Oct 11 06:26:30 UTC 2007 

=========================================================== 
Ubuntu Security Notice USN-528-1           October 11, 2007
mysql-dfsg-5.0 vulnerabilities
CVE-2007-2583, CVE-2007-2691, CVE-2007-3780, CVE-2007-3782
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  mysql-server-5.0                5.0.22-0ubuntu6.06.5

Ubuntu 6.10:
  mysql-server-5.0                5.0.24a-9ubuntu2.1

Ubuntu 7.04:
  mysql-server-5.0                5.0.38-0ubuntu1.1

In general, a standard system upgrade is sufficient to affect the
necessary changes.

ATTENTION: A change was made to the init script for mysql.  Now on
start-up, mysql is checked to make sure that the mysql root password is
set. If it is blank, a message is sent to the console and the system
logger alerting that the password is not set, along with instructions
on how to set it. Additionally, you can now use:

  sudo /etc/init.d/mysql reset-password

to set the root mysql user's password.

Details follow:

Neil Kettle discovered that MySQL could be made to dereference a NULL
pointer and divide by zero.  An authenticated user could exploit this
with a crafted IF clause, leading to a denial of service. (CVE-2007-2583)

Victoria Reznichenko discovered that MySQL did not always require the
DROP privilege.  An authenticated user could exploit this via RENAME
TABLE statements to rename arbitrary tables, possibly gaining additional
database access. (CVE-2007-2691)

It was discovered that MySQL could be made to overflow a signed char
during authentication.  Remote attackers could use crafted authentication
requests to cause a denial of service. (CVE-2007-3780)

Phil Anderton discovered that MySQL did not properly verify access
privileges when accessing external tables.  As a result, authenticated
users could exploit this to obtain UPDATE privileges to external
tables. (CVE-2007-3782)

In certain situations, when installing or upgrading mysql, there was no
notification that the mysql root user password needed to be set.  If the
password was left unset, attackers would be able to obtain unrestricted
access to mysql.  This is now checked during mysql start-up.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.22-0ubuntu6.06.5.diff.gz
      Size/MD5:   136815 2ee9310c1637f93e11018eb97f9869be
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.22-0ubuntu6.06.5.dsc
      Size/MD5:     1107 ab778bf06352edb36a0fa19284f2288b
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.22.orig.tar.gz
      Size/MD5: 18446645 2b8f36364373461190126817ec872031

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client_5.0.22-0ubuntu6.06.5_all.deb
      Size/MD5:    37388 275b38cbafa4304811a6f2127924a0f6
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-common_5.0.22-0ubuntu6.06.5_all.deb
      Size/MD5:    39892 c5167fd4319f83879893c836436050f9
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server_5.0.22-0ubuntu6.06.5_all.deb
      Size/MD5:    37398 1ee71fa600d8408997ce89bdc4b9f7c6

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.22-0ubuntu6.06.5_amd64.deb
      Size/MD5:  6726370 4e4070345c2bce927957ecbc13d3e374
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.22-0ubuntu6.06.5_amd64.deb
      Size/MD5:  1422286 10e53e36a0688870a82291a3edb5339e
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.22-0ubuntu6.06.5_amd64.deb
      Size/MD5:  6895754 de1ce4dc0415f7d098c2d20615307ec1
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.22-0ubuntu6.06.5_amd64.deb
      Size/MD5: 22490856 28c02acdf90f9f90792a356831af52cc

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.22-0ubuntu6.06.5_i386.deb
      Size/MD5:  6140062 dd3ac2c52870c087fe219f0fbeb2f752
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.22-0ubuntu6.06.5_i386.deb
      Size/MD5:  1382756 ba60b2fcd47aebab479f0142ffab7d61
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.22-0ubuntu6.06.5_i386.deb
      Size/MD5:  6278314 5cbc3b700a9f93e0e4f5fbb3aed135cb
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.22-0ubuntu6.06.5_i386.deb
      Size/MD5: 21348936 36e9d8b906f5d9e74234f834d63f7f9d

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.22-0ubuntu6.06.5_powerpc.deb
      Size/MD5:  6883652 4f5f003ab2fb4e801c7b55c9e04e1fb0
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.22-0ubuntu6.06.5_powerpc.deb
      Size/MD5:  1462642 a66d382783bedbf4c2ad57f1b763d4a2
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.22-0ubuntu6.06.5_powerpc.deb
      Size/MD5:  6940358 00d98f99e72e2300ca62fa60f6197502
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.22-0ubuntu6.06.5_powerpc.deb
      Size/MD5: 22704382 07d7feaed935ee0542589c35508b20d4

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.22-0ubuntu6.06.5_sparc.deb
      Size/MD5:  6431340 89f75bfa3afa604853fafe212e6595cf
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.22-0ubuntu6.06.5_sparc.deb
      Size/MD5:  1434724 b9058a1caad8d21d875bc75f9f8d60b1
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.22-0ubuntu6.06.5_sparc.deb
      Size/MD5:  6536152 f3fd415edaed579a14437c4ee5ed89de
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.22-0ubuntu6.06.5_sparc.deb
      Size/MD5: 21970112 2236df1c10fd9f8c3186538930ba7d76

Updated packages for Ubuntu 6.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.24a-9ubuntu2.1.diff.gz
      Size/MD5:   144500 1b7a672d9776990ff2d877db496c840e
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.24a-9ubuntu2.1.dsc
      Size/MD5:     1103 e42e629b8347840d1208d090b0df0107
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.24a.orig.tar.gz
      Size/MD5: 18663598 9641fcc4f34b4a2651d1aabb3b72a971

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client_5.0.24a-9ubuntu2.1_all.deb
      Size/MD5:    40008 03d5a2539703b0a8dc4b820935475ebb
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-common_5.0.24a-9ubuntu2.1_all.deb
      Size/MD5:    42636 92d63cd292c7b8109b2af60b7a47e3c6
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server_5.0.24a-9ubuntu2.1_all.deb
      Size/MD5:    40010 38c38470a3aab199585defbd179bb925

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.24a-9ubuntu2.1_amd64.deb
      Size/MD5:  7293618 cbeefb8354a5c22b8fde0e5e422999ec
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.24a-9ubuntu2.1_amd64.deb
      Size/MD5:  1815054 02cb8e56c67d2f26068e883ea94e948a
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.24a-9ubuntu2.1_amd64.deb
      Size/MD5:  7432812 0ebf5066c4e9015239801f46df0347bd
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.24a-9ubuntu2.1_amd64.deb
      Size/MD5: 25706206 f863864c4a259f7114b182f5d9ccf5a1

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.24a-9ubuntu2.1_i386.deb
      Size/MD5:  6812954 4d2a81c4039273d83b031f601e68e297
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.24a-9ubuntu2.1_i386.deb
      Size/MD5:  1760350 dabac2c1945048eb89ea960637532f10
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.24a-9ubuntu2.1_i386.deb
      Size/MD5:  6955736 3da01222cb928829475ebcb538b363af
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.24a-9ubuntu2.1_i386.deb
      Size/MD5: 24937436 90182b36491b66d62e24a804634bb570

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.24a-9ubuntu2.1_powerpc.deb
      Size/MD5:  7435444 ec713d710bd8fb5356ce87e1012f9a4d
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.24a-9ubuntu2.1_powerpc.deb
      Size/MD5:  1810108 21778248de27b14f6d69774412693a01
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.24a-9ubuntu2.1_powerpc.deb
      Size/MD5:  7470568 87fd8065ae2c2a235568a629235b0868
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.24a-9ubuntu2.1_powerpc.deb
      Size/MD5: 26070012 2385594643de4ee42c25b3881c92e01c

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.24a-9ubuntu2.1_sparc.deb
      Size/MD5:  6942742 ca10a0db660f04ef8dcdb8cafca15ebb
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.24a-9ubuntu2.1_sparc.deb
      Size/MD5:  1771480 f494d1f1ee05a672d1dbc98797e5b40a
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.24a-9ubuntu2.1_sparc.deb
      Size/MD5:  7048314 7a1a2cb0578b2d9f294957dec1025e31
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.24a-9ubuntu2.1_sparc.deb
      Size/MD5: 25302728 02d905d78fff0c52241d666760652a74

Updated packages for Ubuntu 7.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.38-0ubuntu1.1.diff.gz
      Size/MD5:   148883 52b584c506693eea79bdf575dbaeabf4
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.38-0ubuntu1.1.dsc
      Size/MD5:     1209 1d2d29837f0327bdb007a6f6bb99d458
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.38.orig.tar.gz
      Size/MD5: 16602385 c661bce63e01401455c2273bfb170a8d

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client_5.0.38-0ubuntu1.1_all.deb
      Size/MD5:    45752 774b8b1290d6a20b29c2fb1d361c589a
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-common_5.0.38-0ubuntu1.1_all.deb
      Size/MD5:    54470 7d12190b5ff1b6c544de13b037a60383
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server_5.0.38-0ubuntu1.1_all.deb
      Size/MD5:    47832 58d912a6ac7f2ed72fd10fea3120a054

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.38-0ubuntu1.1_amd64.deb
      Size/MD5:  7450360 788e9a7d6effee15327804fd87a509df
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.38-0ubuntu1.1_amd64.deb
      Size/MD5:  1891972 2585d88d50347e3eff795e8d050bb9fb
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.38-0ubuntu1.1_amd64.deb
      Size/MD5:  7850734 339b83fa3a7476fb976cee4c56d6ea0b
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.38-0ubuntu1.1_amd64.deb
      Size/MD5:    47852 f7f22b793bd9be902e3e3f28bc661028
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.38-0ubuntu1.1_amd64.deb
      Size/MD5: 26506454 3479e2d61c01b69c6dc193f3e1418340

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.38-0ubuntu1.1_i386.deb
      Size/MD5:  6951826 f38b783bec8bf54762e2af610e2eb27e
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.38-0ubuntu1.1_i386.deb
      Size/MD5:  1834950 b99e28cdd22943c3001b5a7beb09e7be
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.38-0ubuntu1.1_i386.deb
      Size/MD5:  7361004 a8260ee2e9acfa657d318120face8c02
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.38-0ubuntu1.1_i386.deb
      Size/MD5:    47854 32e151e1d7dab5ebac33623ffc9e86d8
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.38-0ubuntu1.1_i386.deb
      Size/MD5: 25740498 eeecc1e7f07e587394924c581f367bd7

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.38-0ubuntu1.1_powerpc.deb
      Size/MD5:  7653930 0380fa4c4a075bd51e574c558533d72a
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.38-0ubuntu1.1_powerpc.deb
      Size/MD5:  1918584 075962f787639cdca6419d6eebfa1324
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.38-0ubuntu1.1_powerpc.deb
      Size/MD5:  7912746 02fbc0f2dd01158c776790680c6f9ff2
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.38-0ubuntu1.1_powerpc.deb
      Size/MD5:    47858 ad466ed4dec1fd6157c52f4e3b5cb6e5
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.38-0ubuntu1.1_powerpc.deb
      Size/MD5: 26977146 3aa11532c1bd46ea1d820ba870900a90

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.38-0ubuntu1.1_sparc.deb
      Size/MD5:  7079614 fb8163f79bc93d0da46f510792630bab
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.38-0ubuntu1.1_sparc.deb
      Size/MD5:  1839596 ed3b9b8a8aca9033cb671e1cb0a0708e
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.38-0ubuntu1.1_sparc.deb
      Size/MD5:  7438302 bc4503ddd8bc44c99cc74c4641725b22
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.38-0ubuntu1.1_sparc.deb
      Size/MD5:    47848 68da3bfe606f6480c625e2a8111556e6
    http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.38-0ubuntu1.1_sparc.deb
      Size/MD5: 26108400 6965b1264ac2f52c5171360bc26c3277

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20071010/ce67f96d/attachment.sig>

More information about the ubuntu-security-announce mailing list