__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN MySQL Security Update [Red Hat RHSA-2007:1155-6] December 18, 2007 22:00 GMT Number S-091 [REVISED 14 Jan 2008] ______________________________________________________________________________ PROBLEM: Several flaws were found in a way: 1) MySQL handled symbolic links when database tables were created with explicit "DATE" and "INDEX DIRECTORY" options; and 2) MySQL's InnoDB engine handled spatial indexes. PLATFORM: RHEL Desktop Workstation (v. 5 client) Red Hat Desktop (v. 4) Red Hat Enterprise Linux (v. 5 server) Red Hat Enterprise Linux AS, ES, WS (v. 4) Red Hat Enterprise Linux Desktop (v. 5 client) Debian GNU/Linux 4.0 (stable) DAMAGE: Data destruction - overwrites tables. SOLUTION: Upgrade to the appropriate verision. ______________________________________________________________________________ VULNERABILITY The risk is LOW. Data destruction - overwrites tables. ASSESSMENT: ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/s-091.shtml ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2007-1155.html ADDITIONAL LINK: http://www.debian.org/security/2008/dsa-1451 CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2007-5969 CVE-2007-5925 ______________________________________________________________________________ REVISION HISTORY: 01/14/2008 - revised S-091 to add a link to Debian Security Advisory DSA-1451-1 for Debian GNU/Linux 4.0 (stable). [***** Start Red Hat RHSA-2007:1155-6 *****] Important: mysql security update Advisory: RHSA-2007:1155-6 Type: Security Advisory Severity: Important Issued on: 2007-12-18 Last updated on: 2007-12-18 Affected Products: RHEL Desktop Workstation (v. 5 client) Red Hat Desktop (v. 4) Red Hat Enterprise Linux (v. 5 server) Red Hat Enterprise Linux AS (v. 4) Red Hat Enterprise Linux Desktop (v. 5 client) Red Hat Enterprise Linux ES (v. 4) Red Hat Enterprise Linux WS (v. 4) OVAL: com.redhat.rhsa-20071155.xml CVEs (cve.mitre.org): CVE-2007-5925 CVE-2007-5969 Details Updated mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld), and many different client programs and libraries. A flaw was found in a way MySQL handled symbolic links when database tables were created with explicit "DATA" and "INDEX DIRECTORY" options. An authenticated user could create a table that would overwrite tables in other databases, causing destruction of data or allowing the user to elevate privileges. (CVE-2007-5969) A flaw was found in a way MySQL's InnoDB engine handled spatial indexes. An authenticated user could create a table with spatial indexes, which are not supported by the InnoDB engine, that would cause the mysql daemon to crash when used. This issue only causes a temporary denial of service, as the mysql daemon will be automatically restarted after the crash. (CVE-2007-5925) All mysql users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. Solution Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 Updated packages RHEL Desktop Workstation (v. 5 client) -------------------------------------------------------------------------------- IA-32: mysql-bench-5.0.22-2.2.el5_1.1.i386.rpm c97e5b3c925352660affdb28cfdac1fb mysql-devel-5.0.22-2.2.el5_1.1.i386.rpm e64dbc1b3a3bdb53d7a8e53952a0c6c0 mysql-server-5.0.22-2.2.el5_1.1.i386.rpm 02235ad2df88bdb6d8d17c0019bac3dd mysql-test-5.0.22-2.2.el5_1.1.i386.rpm 6e59b90929d818b26a441304c1853eaa x86_64: mysql-bench-5.0.22-2.2.el5_1.1.x86_64.rpm 38487f1a2d8deeba984038448eb172ae mysql-devel-5.0.22-2.2.el5_1.1.i386.rpm e64dbc1b3a3bdb53d7a8e53952a0c6c0 mysql-devel-5.0.22-2.2.el5_1.1.x86_64.rpm eb90903e4ae7a2fbe8357fde6ec3c357 mysql-server-5.0.22-2.2.el5_1.1.x86_64.rpm 1ba9dd9f34b5b1ecb7ccc8167cd459a5 mysql-test-5.0.22-2.2.el5_1.1.x86_64.rpm 995d71b15bdef4b4c6f84fab8b5d869e Red Hat Desktop (v. 4) -------------------------------------------------------------------------------- SRPMS: mysql-4.1.20-3.RHEL4.1.el4_6.1.src.rpm 1854535e652c2293f7c74d2d7a81b2bf IA-32: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 7f3ffede94c61972847e43795a8a7319 mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 2b1bd8db5655be3a64d454b0bbb14465 mysql-server-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm b7ea46af22ef0ef8090c13d86c9e30b7 x86_64: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm d5dcfe0b48fa140264a125a1b1c26f3a mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm 3e3b031841c62189290af3480373fba0 mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm ccde316f14672eda04fc25eefac3d7fa mysql-server-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm 498a0c429f46de530e50309d921b63a7 Red Hat Enterprise Linux (v. 5 server) -------------------------------------------------------------------------------- SRPMS: mysql-5.0.22-2.2.el5_1.1.src.rpm 1e9aab3d2dad0c5e18704a1310577655 IA-32: mysql-5.0.22-2.2.el5_1.1.i386.rpm c75889dc568cb7ca5f91672cec4d2c72 mysql-bench-5.0.22-2.2.el5_1.1.i386.rpm c97e5b3c925352660affdb28cfdac1fb mysql-devel-5.0.22-2.2.el5_1.1.i386.rpm e64dbc1b3a3bdb53d7a8e53952a0c6c0 mysql-server-5.0.22-2.2.el5_1.1.i386.rpm 02235ad2df88bdb6d8d17c0019bac3dd mysql-test-5.0.22-2.2.el5_1.1.i386.rpm 6e59b90929d818b26a441304c1853eaa IA-64: mysql-5.0.22-2.2.el5_1.1.i386.rpm c75889dc568cb7ca5f91672cec4d2c72 mysql-5.0.22-2.2.el5_1.1.ia64.rpm 5d1e675a949114820147f10cba548876 mysql-bench-5.0.22-2.2.el5_1.1.ia64.rpm e0611ab43c83ceb3e142b811c6488871 mysql-devel-5.0.22-2.2.el5_1.1.ia64.rpm 2c1f29afba6f48914a721f8ebc7baec3 mysql-server-5.0.22-2.2.el5_1.1.ia64.rpm 9d8240d6d4949e94929ff23cbc7601cd mysql-test-5.0.22-2.2.el5_1.1.ia64.rpm 9279d9b01a6fa1c62beb4c1a52f6613b PPC: mysql-5.0.22-2.2.el5_1.1.ppc.rpm 6b8463bca11bcc572300a24cb35d6fdc mysql-5.0.22-2.2.el5_1.1.ppc64.rpm e48ac3b1dce1bec353ba3f6e2e5fe231 mysql-bench-5.0.22-2.2.el5_1.1.ppc.rpm 51d3b7ff981374ea4b9340f6fdbc27d7 mysql-devel-5.0.22-2.2.el5_1.1.ppc.rpm e8f7fc31923cfb4d19276fa76afecdec mysql-devel-5.0.22-2.2.el5_1.1.ppc64.rpm 3c77a3843eed86046574103b896d3e9e mysql-server-5.0.22-2.2.el5_1.1.ppc.rpm 2573b0bc68ef343b80259caa32671207 mysql-test-5.0.22-2.2.el5_1.1.ppc.rpm d40e7b9e1695d2b6ae655ed8e77c76f3 s390x: mysql-5.0.22-2.2.el5_1.1.s390.rpm e91967507a4b2ad8b549f3c793b5db0f mysql-5.0.22-2.2.el5_1.1.s390x.rpm a49e1879d5e41ba677aa212398ff6c96 mysql-bench-5.0.22-2.2.el5_1.1.s390x.rpm f52f0eec9ee6fdac6014cbf696d85bef mysql-devel-5.0.22-2.2.el5_1.1.s390.rpm 07ecfba53a429d586c9be5ba683b1143 mysql-devel-5.0.22-2.2.el5_1.1.s390x.rpm bdb7d8b4d8d6356e33ec79a081b604a3 mysql-server-5.0.22-2.2.el5_1.1.s390x.rpm fa5fcdc0ebcbb3c1672863917a2420a9 mysql-test-5.0.22-2.2.el5_1.1.s390x.rpm 33481d82c53cdf4bddf31b4308896d36 x86_64: mysql-5.0.22-2.2.el5_1.1.i386.rpm c75889dc568cb7ca5f91672cec4d2c72 mysql-5.0.22-2.2.el5_1.1.x86_64.rpm f99bf6ee7efbca43fd93ff705dafc906 mysql-bench-5.0.22-2.2.el5_1.1.x86_64.rpm 38487f1a2d8deeba984038448eb172ae mysql-devel-5.0.22-2.2.el5_1.1.i386.rpm e64dbc1b3a3bdb53d7a8e53952a0c6c0 mysql-devel-5.0.22-2.2.el5_1.1.x86_64.rpm eb90903e4ae7a2fbe8357fde6ec3c357 mysql-server-5.0.22-2.2.el5_1.1.x86_64.rpm 1ba9dd9f34b5b1ecb7ccc8167cd459a5 mysql-test-5.0.22-2.2.el5_1.1.x86_64.rpm 995d71b15bdef4b4c6f84fab8b5d869e Red Hat Enterprise Linux AS (v. 4) -------------------------------------------------------------------------------- SRPMS: mysql-4.1.20-3.RHEL4.1.el4_6.1.src.rpm 1854535e652c2293f7c74d2d7a81b2bf IA-32: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 7f3ffede94c61972847e43795a8a7319 mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 2b1bd8db5655be3a64d454b0bbb14465 mysql-server-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm b7ea46af22ef0ef8090c13d86c9e30b7 IA-64: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm 27dfcb1cf5ef0286bf05d71f0cfc147d mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm 533ffa791ddbd3da1d9226b7b417ec5c mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm d13ec7721c0d38a23bafa2b21e0cedcd mysql-server-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm 963b668c8c77e2055a563b32a8f4ca80 PPC: mysql-4.1.20-3.RHEL4.1.el4_6.1.ppc.rpm bdbf7956d4992b3ea8d29a9fdce21b8f mysql-4.1.20-3.RHEL4.1.el4_6.1.ppc64.rpm 9c9c631bde64bfdbb053e135f78ccca4 mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.ppc.rpm c113c36a612342bed0edd1c6ceb4e593 mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.ppc.rpm a10ef5cfd2753f58c603a646341b1bea mysql-server-4.1.20-3.RHEL4.1.el4_6.1.ppc.rpm c0c2a9547931f8400357b23eddd24947 s390: mysql-4.1.20-3.RHEL4.1.el4_6.1.s390.rpm 09a3d3d6b69e90a6b62ff4da87a846e5 mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.s390.rpm ad8385135ccb4aeb02892d7c06acb406 mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.s390.rpm 77fc7f7db4c9a03205782c2ea232c5c8 mysql-server-4.1.20-3.RHEL4.1.el4_6.1.s390.rpm 760d3f7e8539ec7608ae5fd4cf1fa157 s390x: mysql-4.1.20-3.RHEL4.1.el4_6.1.s390.rpm 09a3d3d6b69e90a6b62ff4da87a846e5 mysql-4.1.20-3.RHEL4.1.el4_6.1.s390x.rpm 443a9b2259455d82b262ccd04ddd3535 mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.s390x.rpm 7ca3b643358dde0288d1a00db4efb1df mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.s390x.rpm 664bfe9b424bf2669e138f070531716e mysql-server-4.1.20-3.RHEL4.1.el4_6.1.s390x.rpm 46acae1f2d6083957e45f3f1c1943faa x86_64: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm d5dcfe0b48fa140264a125a1b1c26f3a mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm 3e3b031841c62189290af3480373fba0 mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm ccde316f14672eda04fc25eefac3d7fa mysql-server-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm 498a0c429f46de530e50309d921b63a7 Red Hat Enterprise Linux Desktop (v. 5 client) -------------------------------------------------------------------------------- SRPMS: mysql-5.0.22-2.2.el5_1.1.src.rpm 1e9aab3d2dad0c5e18704a1310577655 IA-32: mysql-5.0.22-2.2.el5_1.1.i386.rpm c75889dc568cb7ca5f91672cec4d2c72 x86_64: mysql-5.0.22-2.2.el5_1.1.i386.rpm c75889dc568cb7ca5f91672cec4d2c72 mysql-5.0.22-2.2.el5_1.1.x86_64.rpm f99bf6ee7efbca43fd93ff705dafc906 Red Hat Enterprise Linux ES (v. 4) -------------------------------------------------------------------------------- SRPMS: mysql-4.1.20-3.RHEL4.1.el4_6.1.src.rpm 1854535e652c2293f7c74d2d7a81b2bf IA-32: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 7f3ffede94c61972847e43795a8a7319 mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 2b1bd8db5655be3a64d454b0bbb14465 mysql-server-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm b7ea46af22ef0ef8090c13d86c9e30b7 IA-64: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm 27dfcb1cf5ef0286bf05d71f0cfc147d mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm 533ffa791ddbd3da1d9226b7b417ec5c mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm d13ec7721c0d38a23bafa2b21e0cedcd mysql-server-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm 963b668c8c77e2055a563b32a8f4ca80 x86_64: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm d5dcfe0b48fa140264a125a1b1c26f3a mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm 3e3b031841c62189290af3480373fba0 mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm ccde316f14672eda04fc25eefac3d7fa mysql-server-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm 498a0c429f46de530e50309d921b63a7 Red Hat Enterprise Linux WS (v. 4) -------------------------------------------------------------------------------- SRPMS: mysql-4.1.20-3.RHEL4.1.el4_6.1.src.rpm 1854535e652c2293f7c74d2d7a81b2bf IA-32: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 7f3ffede94c61972847e43795a8a7319 mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 2b1bd8db5655be3a64d454b0bbb14465 mysql-server-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm b7ea46af22ef0ef8090c13d86c9e30b7 IA-64: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm 27dfcb1cf5ef0286bf05d71f0cfc147d mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm 533ffa791ddbd3da1d9226b7b417ec5c mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm d13ec7721c0d38a23bafa2b21e0cedcd mysql-server-4.1.20-3.RHEL4.1.el4_6.1.ia64.rpm 963b668c8c77e2055a563b32a8f4ca80 x86_64: mysql-4.1.20-3.RHEL4.1.el4_6.1.i386.rpm 531fbbccb4ec6db747d64b9457741e6e mysql-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm d5dcfe0b48fa140264a125a1b1c26f3a mysql-bench-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm 3e3b031841c62189290af3480373fba0 mysql-devel-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm ccde316f14672eda04fc25eefac3d7fa mysql-server-4.1.20-3.RHEL4.1.el4_6.1.x86_64.rpm 498a0c429f46de530e50309d921b63a7 (The unlinked packages above are only available from the Red Hat Network) Bugs fixed (see bugzilla for more information) 377451 - CVE-2007-5925 mysql DoS in the InnoDB Engine 397071 - CVE-2007-5969 mysql: possible system table information overwrite using symlinks References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5925 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5969 http://www.redhat.com/security/updates/classification/#important -------------------------------------------------------------------------------- These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from: https://www.redhat.com/security/team/key/#package The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/ [***** End Red Hat RHSA-2007:1155-6 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) S-081: autofs Security Update S-082: Linux-2.6 Vulnerabilities S-083: Sitebar Vulnerabilities S-084: Ruby-Gnome2 Vulnerability S-085: e2fsprogs S-086: qt-x11-free Vulnerabilities S-087: centericq Vulnerability S-088: HP Quick Launch Button (QLB) Running on Windows Vulnerability S-089: Prolog Manager Vulnerability S-090: Apple Security Update 2007-009