Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1017-1)

Ubuntu Security Notice (C) 2010-2013 Canonical, Inc. / NASL script (C) 2010-2013 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

It was discovered that MySQL incorrectly handled certain requests with
the UPGRADE DATA DIRECTORY NAME command. An authenticated user could
exploit this to make MySQL crash, causing a denial of service. This
issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-2008)

It was discovered that MySQL incorrectly handled joins involving a
table with a unique SET column. An authenticated user could exploit
this to make MySQL crash, causing a denial of service. This issue only
affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS.
(CVE-2010-3677)

It was discovered that MySQL incorrectly handled NULL arguments to
IN() or CASE operations. An authenticated user could exploit this to
make MySQL crash, causing a denial of service. This issue only
affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-3678)

It was discovered that MySQL incorrectly handled malformed arguments
to the BINLOG statement. An authenticated user could exploit this to
make MySQL crash, causing a denial of service. This issue only
affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-3679)

It was discovered that MySQL incorrectly handled the use of TEMPORARY
InnoDB tables with nullable columns. An authenticated user could
exploit this to make MySQL crash, causing a denial of service. This
issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS.
(CVE-2010-3680)

It was discovered that MySQL incorrectly handled alternate reads from
two indexes on a table using the HANDLER interface. An authenticated
user could exploit this to make MySQL crash, causing a denial of
service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and
10.04 LTS. (CVE-2010-3681)

It was discovered that MySQL incorrectly handled use of EXPLAIN with
certain queries. An authenticated user could exploit this to make
MySQL crash, causing a denial of service. This issue only affected
Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-3682)

It was discovered that MySQL incorrectly handled error reporting when
using LOAD DATA INFILE and would incorrectly raise an assert in
certain circumstances. An authenticated user could exploit this to
make MySQL crash, causing a denial of service. This issue only
affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-3683)

It was discovered that MySQL incorrectly handled propagation during
evaluation of arguments to extreme-value functions. An authenticated
user could exploit this to make MySQL crash, causing a denial of
service. This issue only affected Ubuntu 8.04 LTS, 9.10, 10.04 LTS and
10.10. (CVE-2010-3833)

It was discovered that MySQL incorrectly handled materializing a
derived table that required a temporary table for grouping. An
authenticated user could exploit this to make MySQL crash, causing a
denial of service. (CVE-2010-3834)

It was discovered that MySQL incorrectly handled certain user-variable
assignment expressions that are evaluated in a logical expression
context. An authenticated user could exploit this to make MySQL crash,
causing a denial of service. This issue only affected Ubuntu 8.04 LTS,
9.10, 10.04 LTS and 10.10. (CVE-2010-3835)

It was discovered that MySQL incorrectly handled pre-evaluation of
LIKE predicates during view preparation. An authenticated user could
exploit this to make MySQL crash, causing a denial of service.
(CVE-2010-3836)

It was discovered that MySQL incorrectly handled using GROUP_CONCAT()
and WITH ROLLUP together. An authenticated user could exploit this to
make MySQL crash, causing a denial of service. (CVE-2010-3837)

It was discovered that MySQL incorrectly handled certain queries using
a mixed list of numeric and LONGBLOB arguments to the GREATEST() or
LEAST() functions. An authenticated user could exploit this to make
MySQL crash, causing a denial of service. (CVE-2010-3838)

It was discovered that MySQL incorrectly handled queries with nested
joins when used from stored procedures and prepared statements. An
authenticated user could exploit this to make MySQL hang, causing a
denial of service. This issue only affected Ubuntu 9.10, 10.04 LTS and
10.10. (CVE-2010-3839)

It was discovered that MySQL incorrectly handled improper WKB data
passed to the PolyFromWKB() function. An authenticated user could
exploit this to make MySQL crash, causing a denial of service.
(CVE-2010-3840).

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 4.1
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true