=================================================================== File: vuln.xml Status: Locally Modified Working revision: 1.401 Repository revision: 1.401 /home/pcvs/ports/security/vuxml/vuln.xml,v Sticky Tag: (none) Sticky Date: (none) Sticky Options: (none) Index: vuln.xml =================================================================== RCS file: /home/pcvs/ports/security/vuxml/vuln.xml,v retrieving revision 1.401 diff -u -r1.401 vuln.xml --- vuln.xml 14 Dec 2004 17:55:51 -0000 1.401 +++ vuln.xml 14 Dec 2004 19:55:03 -0000 @@ -32,6 +32,235 @@ --> + + + MySQL -- ALTER TABLE .. RENAME access restriction problem + + + mysql40-server + + 4.0.21 + + + mysql323-server + 3.23.59 + + + + + +

+ Oleksandr Byelkin discovered that "ALTER TABLE .. RENAME" queries + checked the CREATE/INSERT rights of the old table instead of the + new one. This could allow malicious users to gain unauthorized + access to data stored by an affected MySQL server. +

+ + + + CAN-2004-0835 + + 11357 + http://bugs.mysql.com/bug.php?id=3270 + http://rhn.redhat.com/errata/RHSA-2004-611.html + + + 2004-03-23 + 2004-12-14 + + + + + + MySQL -- ALTER MERGE denial of service vulnerability + + + mysql40-server + + 4.0.21 + + + mysql323-server + 3.23.59 + + + + mysql41-server + 4.1.1 + + + + +

+ Dean Ellis reported a denial of service vulnerability in the MySQL server: +

+ +

+
+ Multiple threads ALTERing the same (or different) MERGE tables to change the + UNION eventually crash the server or hang the individual threads. +
+

+ Note that a script demonstrating the problem is included in the + MySQL bug report. Attackers that have control of a MySQL account + could easily use a modified version of that script during an attack. +

+ + + + + CAN-2004-0837 + 11357 + http://bugs.mysql.com/bug.php?id=2408 + http://rhn.redhat.com/errata/RHSA-2004-611.html + + + + 2004-01-15 + 2004-12-14 + + + + + MySQL -- FTS request denial of service vulnerability + + + + mysql40-server + 4.0.21 + + + + +

+ + A special crafted MySQL FTS query can cause the server to crash. + Malicious MySQL users can abuse this bug in a denial of service + attack against systems running an affected MySQL daemon. +

+ Note that because this bug is related to the parsing of requests + it may happen that this bug is triggered accidently by a user when he + or she makes a typo in an SQL query. +

+ + + + http://bugs.mysql.com/bug.php?id=3870 + CAN-2004-0956 + + 11432 + + + 2004-03-23 + 2004-12-14 + + + + + MySQL -- GRANT access restriction problem + + + mysql40-server + 4.0.21 + + + + + +

+ When a user is granted access to a database with a name containing an + underscore and the underscore is not escaped then that user might + also be able to access other, similarly named, databases on the + affected system. +

+ The problem is that the underscore is seen as a wildcard by MySQL + and therefore it is possible that an admin might accidently GRANT + a user access to multiple databases. +

+ + + + + CAN-2004-0957 + 11435 + http://bugs.mysql.com/bug.php?id=3933 + http://rhn.redhat.com/errata/RHSA-2004-611.html + http://www.openpkg.org/security/OpenPKG-SA-2004.045-mysql.html + + + + 2004-03-29 + 2004-12-14 + + + + + + MySQL -- mysql_real_connect buffer overflow vulnerability + + + mysql40-server + 4.0.21 + + + + mysql40-client + 4.0.21 + + + mysql323-client + 3.23.59 + + + + mysql323-server + 3.23.59 + + + + +

+ + The mysql_real_connect function doesn't properly handle DNS replies + by copying the IP address into a buffer without any length checking. + A specially crafted DNS reply may therefore be used to cause a + buffer overflow on affected systems. +

+ Note that whether this issue can be exploitable depends on the system library responsible for + the gethostbyname function. The bug finder, Lukasz Wojtow, explaines this with the following + words: +

+
+ In glibc there is a limitation for an IP address to have only 4 + bytes (obviously), but generally speaking the length of the address + comes with a response for dns query (i know it sounds funny but + read rfc1035 if you don't believe). This bug can occur on libraries + where gethostbyname function takes length from dns's response +
+

+ + + + + CAN-2004-0836 + 10981 + http://bugs.mysql.com/bug.php?id=4017 + http://lists.mysql.com/internals/14726 + + http://rhn.redhat.com/errata/RHSA-2004-611.html + http://www.osvdb.org/displayvuln.php?osvdb_id=10658 + + + 2004-06-04 + 2004-12-14 + + + wget -- multiple vulnerabilities