Stack-based buffer overflow in the init_syms function in MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta allows remote authenticated users who can create user-defined functions to execute arbitrary code via a long function_name field.

USN-180-1 fixed a vulnerability in the mysql-server package (which ships version 4.0). Version 4.1 is vulnerable against the same flaw.

Please note that this package is not officially supported in Ubuntu 5.10.

Origial advisory :

'AppSecInc Team SHATTER discovered a buffer overflow in the 'CREATE FUNCTION' statement. By specifying a specially crafted long function name, a local or remote attacker with function creation privileges could crash the server or execute arbitrary code with server privileges.

However, the right to create function is usually not granted to untrusted users.'.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

AppSecInc Team SHATTER discovered a buffer overflow in the 'CREATE FUNCTION' statement. By specifying a specially crafted long function name, a local or remote attacker with function creation privileges could crash the server or execute arbitrary code with server privileges.

However, the right to create function is usually not granted to untrusted users.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A stack-based buffer overflow was discovered in the init_syms function in MySQL that allows authenticated users that can create user-defined functions to execute arbitrary code via a long function_name field.

The updated packages have been patched to address these issues.

This update only covers binary packages for the big endian MIPS architecture that was mysteriously forgotten in the earlier update.
For completeness below is the original advisory text :

  A stack-based buffer overflow in the init_syms function of MySQL, a   popular database, has been discovered that allows remote   authenticated users who can create user-defined functions to execute   arbitrary code via a long function_name field. The ability to create   user-defined functions is not typically granted to untrusted users.

The following vulnerability matrix explains which version of MySQL in which distribution has this problem fixed :

                   woody            sarge            sid                mysql            3.23.49-8.14     n/a              n/a                mysql-dfsg       n/a              4.0.24-10sarge1  4.0.24-10sarge1    mysql-dfsg-4.1   n/a              4.1.11a-4sarge2  4.1.14-2           mysql-dfsg-5.0   n/a              n/a              5.0.11beta-3

A stack-based buffer overflow in the init_syms function of MySQL, a popular database, has been discovered that allows remote authenticated users who can create user-defined functions to execute arbitrary code via a long function_name field. The ability to create user-defined functions is not typically granted to untrusted users.

The following vulnerability matrix shows which version of MySQL in which distribution has this problem fixed :

                   woody            sarge            sid                mysql            3.23.49-8.14     n/a              n/a                mysql-dfsg       n/a              4.0.24-10sarge1  4.0.24-10sarge1    mysql-dfsg-4.1   n/a              4.1.11a-4sarge2  4.1.14-2           mysql-dfsg-5.0   n/a              n/a              5.0.11beta-3

According to its version number, the installation of MySQL on the remote host is potentially affected by two flaws :

  - A buffer overflow can be triggered when copying the name of a     user-defined function into a stack-based buffer. With     sufficient access to create a user-defined function, an     attacker may be able to exploit this and execute arbitrary     code within the context of the affected database server     process. (CVE-2005-2558)

  - The mysql_create_function is not fully protected against     directory traversal attacks. On Windows, arbitrary files can     be included by using backslash characters. (CVE-2005-2573)

According to its version number, the installation of MySQL on the remote host may be prone to a buffer overflow when copying the name of a user-defined function into a stack-based buffer.  With sufficient access to create a user-defined function, an attacker may be able to exploit this and execute arbitrary code within the context of the affected database server process. 

ID	Name	Product	Family	Severity
20760	Ubuntu 5.10 : mysql-dfsg-4.1 vulnerability (USN-180-2)	Nessus	Ubuntu Local Security Checks	medium
20591	Ubuntu 4.10 / 5.04 : mysql-dfsg vulnerability (USN-180-1)	Nessus	Ubuntu Local Security Checks	medium
19918	Mandrake Linux Security Advisory : MySQL (MDKSA-2005:163)	Nessus	Mandriva Local Security Checks	medium
19802	Debian DSA-833-2 : mysql-dfsg-4.1 - buffer overflow	Nessus	Debian Local Security Checks	medium
19800	Debian DSA-831-1 : mysql-dfsg - buffer overflow	Nessus	Debian Local Security Checks	medium
19798	Debian DSA-829-1 : mysql - buffer overflow	Nessus	Debian Local Security Checks	medium
19416	MySQL < 4.0.25 / 4.1.13 / 5.0.7 Multiple Vulnerabilies	Nessus	Databases	medium
3158	Oracle MySQL User-Defined Function init_syms() Overflow	Nessus Network Monitor	Database	medium
801121	MySQL User-Defined Function init_syms() Overflow	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2005-2558

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium