Scientific Linux Security Update : mysql on SL5.x i386/x86_64

This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

A buffer overflow flaw was found in the way MySQL handled the
parameters of the MySQL COM_FIELD_LIST network protocol command (this
command is sent when a client uses the MySQL mysql_list_fields()
client library function). An authenticated database user could send a
request with an excessively long table name to cause a temporary
denial of service (mysqld crash) or, potentially, execute arbitrary
code with the privileges of the database server. (CVE-2010-1850)

A directory traversal flaw was found in the way MySQL handled the
parameters of the MySQL COM_FIELD_LIST network protocol command. An
authenticated database user could use this flaw to obtain descriptions
of the fields of an arbitrary table using a request with a specially
crafted table name. (CVE-2010-1848)

A flaw was discovered in the way MySQL handled symbolic links to
tables created using the DATA DIRECTORY and INDEX DIRECTORY directives
in CREATE TABLE statements. An attacker with CREATE and DROP table
privileges, and shell access to the database server, could use this
flaw to remove data and index files of tables created by other
database users using the MyISAM storage engine. (CVE-2010-1626)

After installing this update, the MySQL server daemon (mysqld) will be
restarted automatically.

See also :

http://www.nessus.org/u?15932d4a

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.5
(CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P)
Public Exploit Available : true

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 60796 ()

Bugtraq ID:

CVE ID: CVE-2010-1626
CVE-2010-1848
CVE-2010-1850