mysql_install_db in MySQL 4.1.x before 4.1.12 and 5.x up to 5.0.4 creates the mysql_install_db.X file with a predictable filename and insecure permissions, which allows local users to execute arbitrary SQL commands by modifying the file's contents.

Updated mysql packages that fix a temporary file flaw and a number of bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries.

An insecure temporary file handling bug was found in the mysql_install_db script. It is possible for a local user to create specially crafted files in /tmp which could allow them to execute arbitrary SQL commands during database installation. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1636 to this issue.

These packages update mysql to version 4.1.12, fixing a number of problems. Also, support for SSL-encrypted connections to the database server is now provided.

All users of mysql are advised to upgrade to these updated packages.

The remote MySQL server is earlier than 4.1.12 / 5.0.4 and thus reportedly creates a temporary file with insecure permissions and a predictable name, which could allow a local user to run arbitrary SQL commands.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:685 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a     client/server implementation consisting of a server daemon (mysqld)     and many different client programs and libraries.

    An insecure temporary file handling bug was found in the mysql_install_db     script. It is possible for a local user to create specially crafted files     in /tmp which could allow them to execute arbitrary SQL commands during     database installation. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-1636 to this issue.

    These packages update mysql to version 4.1.12, fixing a number of problems.
    Also, support for SSL-encrypted connections to the database server is now     provided.

    All users of mysql are advised to upgrade to these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Eric Romang discovered a temporary file vulnerability in a script accompanied with MySQL, a popular database, that allows an attacker to execute arbitrary SQL commands when the server is installed or updated.

The old stable distribution (woody) as well as mysql-dfsg are not affected by this problem.

A Zataz advisory reports that MySQL contains a security flaw which could allow a malicious local user to inject arbitrary SQL commands during the initial database creation process.

The problem lies in the mysql_install_db script which creates temporary files based on the PID used by the script.

ID	Name	Product	Family	Severity
67032	CentOS 4 : mysql (CESA-2005:685)	Nessus	CentOS Local Security Checks	medium
17805	MySQL < 4.1.12 / 5.0.4 Insecure Permissions	Nessus	Databases	medium
19993	RHEL 4 : mysql (RHSA-2005:685)	Nessus	Red Hat Local Security Checks	high
19526	Debian DSA-783-1 : mysql-dfsg-4.1 - insecure temporary file	Nessus	Debian Local Security Checks	medium
19160	FreeBSD : mysql-server -- insecure temporary file creation (eeae6cce-d05c-11d9-9aed-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2005-1636

high

Tenable Plugins

medium

medium

high

medium

medium