MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation, which could allow attackers to conduct unauthorized activities.

SunOS 5.10_x86 : mysql patch.
Date this patch was last updated by Sun : Jun/27/08

SunOS 5.10 : mysql patch.
Date this patch was last updated by Sun : Jun/27/08

A Red Hat advisory reports :

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one.

Table access restrictions, on the affected MySQL servers, may accidentally or intentionally be bypassed due to this bug.

Several problems have been discovered in MySQL, a commonly used SQL database on Unix servers. The following problems have been identified by the Common Vulnerabilities and Exposures Project :

  - CAN-2004-0835     Oleksandr Byelkin noticed that ALTER TABLE ... RENAME     checks CREATE/INSERT rights of the old table instead of     the new one.

  - CAN-2004-0836

    Lukasz Wojtow noticed a buffer overrun in the     mysql_real_connect function.

  - CAN-2004-0837

    Dean Ellis noticed that multiple threads ALTERing the     same (or different) MERGE tables to change the UNION can     cause the server to crash or stall.

An updated mysql-server package that fixes various security issues is now available in the Red Hat Enterprise Linux 3 Extras channel of Red Hat Network.

MySQL is a multi-user, multi-threaded SQL database server.

A number of security issues that affect the mysql-server package have been reported. Although Red Hat Enterprise Linux 3 does not ship with the mysql-server package, the affected package is available from the Red Hat Network Extras channel.

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Users of mysql-server should upgrade to these erratum packages, which correct these issues.

A number of problems have been discovered in the MySQL database server :

Jeroen van Wolffelaar discovered an insecure temporary file vulnerability in the mysqlhotcopy script when using the scp method (CVE-2004-0457).

Oleksandr Byelkin discovered that the 'ALTER TABLE ... RENAME' would check the CREATE/INSERT rights of the old table rather than the new one (CVE-2004-0835).

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION can cause the server to crash or stall (CVE-2004-0837).

The updated MySQL packages have been patched to protect against these issues.

The remote host is affected by the vulnerability described in GLSA-200410-22 (MySQL: Multiple vulnerabilities)

    The following vulnerabilities were found and fixed in MySQL:
    Oleksandr Byelkin found that ALTER TABLE ... RENAME checks CREATE/INSERT     rights of the old table instead of the new one (CAN-2004-0835). Another     privilege checking bug allowed users to grant rights on a database they had     no rights on.
    Dean Ellis found a defect where multiple threads ALTERing the MERGE tables     to change the UNION could cause the server to crash (CAN-2004-0837).
    Another crash was found in MATCH ... AGAINST() queries with missing closing     double quote.
    Finally, a buffer overrun in the mysql_real_connect function was found by     Lukasz Wojtow (CAN-2004-0836).
  Impact :

    The privilege checking issues could be used by remote users to bypass their     rights on databases. The two crashes issues could be exploited by a remote     user to perform a Denial of Service attack on MySQL server. The buffer     overrun issue could also be exploited as a Denial of Service attack, and     may allow to execute arbitrary code with the rights of the MySQL daemon     (typically, the 'mysql' user).
  Workaround :

    There is no known workaround at this time.

Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1.

MySQL is a multi-user, multi-threaded SQL database server.

A number security issues that affect the mysql server have been reported :

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Additionally, the following minor temporary file vulnerabilities were discovered :

  - Stan Bubroski and Shaun Colley found a temporary file     vulnerability in the mysqlbug script (CVE-2004-0381). -     A temporary file vulnerability was discovered in     mysqld_multi (CVE-2004-0388). - Jeroen van Wolffelaar     discovered an temporary file vulnerability in the     mysqlhotcopy script when using the scp method     (CVE-2004-0457).

All users of mysql should upgrade to these updated packages, which resolve these issues and also include fixes for a number of small bugs.

The remote host is running a version of the MySQL database that is older than 4.0.21.

MySQL is a database that runs on both Linux/BSD and Windows platforms.
The remote version of this software is vulnerable to specially crafted ALTER TABLE SQL query that can be exploited to bypass some applied security restrictions or cause a denial of service.

To exploit this flaw, an attacker would need the ability to execute arbitrary SQL statements on the remote host. 

The remote host is running a version of the MySQL database that is older than 3.23.59.

MySQL is a database that runs on both Linux/BSD and Windows platforms.
The remote version of this software is vulnerable to specially crafted ALTER TABLE SQL query that can be exploited to bypass some applied security restrictions or cause a denial of service.

To exploit this flaw, an attacker would need the ability to execute arbitrary SQL statements on the remote host. 

The remote host is running a version of the MySQL database which is older than 4.0.21 or 3.23.59.

MySQL is a database which runs on both Linux/BSD and Windows platform.
The remote version of this software is vulnerable to specially crafted 'ALTER TABLE SQL' query which can be exploited to bypass some applied security restrictions or cause a denial of service.

To exploit this flaw, an attacker would need the ability to execute arbitrary SQL statements on the remote host.

The remote host is running a version of MySQL that is older than version 3.23.49 or than 4.0.20.  The version of the utility Mysqlhotcopy included in these versions of MySQL is reported to be prone to a vulnerability that may permit an attacker to overwrite arbitrary files on the database server with the privilege of the targeted user. Privilege escalation may also be possible. An attacker requires local interactive access in order to exploit this vulnerability. 

ID	Name	Product	Family	Type	Severity
107863	Solaris 10 (x86) : 120293-02	Nessus	Solaris Local Security Checks	Local	high
107361	Solaris 10 (sparc) : 120292-02	Nessus	Solaris Local Security Checks	Local	high
18823	FreeBSD : mysql -- erroneous access restrictions applied to table renames (035d17b2-484a-11d9-813c-00065be4b5b6)	Nessus	FreeBSD Local Security Checks	Local	high
15660	Debian DSA-562-1 : mysql - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
15631	RHEL 3 : mysql-server (RHSA-2004:611)	Nessus	Red Hat Local Security Checks	Local	critical
15599	Mandrake Linux Security Advisory : MySQL (MDKSA-2004:119)	Nessus	Mandriva Local Security Checks	Local	critical
15558	GLSA-200410-22 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
15536	RHEL 2.1 : mysql (RHSA-2004:597)	Nessus	Red Hat Local Security Checks	Local	critical
2362	Oracle MySQL < 4.0.21 Multiple Vulnerabilities (2)	Nessus Network Monitor	Database		high
2361	Oracle MySQL < 3.23.59 Multiple Vulnerabilities (2)	Nessus Network Monitor	Database		high
15449	MySQL < 3.23.59 / 4.0.21 Multiple Vulnerabilities	Nessus	Databases	Remote	high
2129	Oracle MySQL Mysqlhotcopy Script Insecure Temporary File Creation	Nessus Network Monitor	Database		high

Detections

Analytics

CVE-2004-0835

high

Tenable Plugins

high

high

high

critical

critical

critical

critical

critical

high

high

high

high