MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0364 advisory.

  - sql_select.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to     cause a denial of service (crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table, as     originally demonstrated using ORDER BY. (CVE-2006-7232)

  - MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing     information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain     structure elements from being initialized and triggers a NULL dereference in the filesort function.
    (CVE-2007-1420)

  - The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows     context-dependent attackers to cause a denial of service (crash) via a crafted IF clause that results in a     divide-by-zero error and a NULL pointer dereference. (CVE-2007-2583)

  - MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for     RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.
    (CVE-2007-2691)

  - The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore     THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote     authenticated users to gain privileges. (CVE-2007-2692)

  - MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a     CREATE TABLE LIKE statement, which allows remote authenticated users to obtain sensitive information such     as the table structure. (CVE-2007-3781)

  - MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a     table in another database via a view that refers to this external table. (CVE-2007-3782)

  - MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the     NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was     originally reported for the mysql_query function, but the vendor states that since mysql_query expects a     null character, this is not an issue for mysql_query. (CVE-2006-0903)

  - MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously     created MERGE table, even after the user's privileges are revoked for the original table, which might     violate intended security policy. (CVE-2006-4031)

  - MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of     the routine's definer instead of the routine's caller, which allows remote authenticated users to gain     privileges through a routine that has been made available using GRANT EXECUTE. (CVE-2006-4227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. (CVE-2007-3781)

A flaw was discovered in MySQL that allowed an authenticated user to gain update privileges for a table in another database, via a view that refers to the external table. (CVE-2007-3782)

MySQL did not require the 'DROP' privilege for 'RENAME TABLE' statements. An authenticated user could use this flaw to rename arbitrary tables. (CVE-2007-2691)

A flaw was discovered in the mysql_change_db function when returning from SQL SECURITY INVOKER stored routines. An authenticated user could use this flaw to gain database privileges. (CVE-2007-2692)

MySQL allowed an authenticated user to bypass logging mechanisms via SQL queries that contain the NULL character, which were not properly handled by the mysql_real_query function. (CVE-2006-0903)

MySQL allowed an authenticated user to access a table through a previously created MERGE table, even after the user's privileges were revoked from the original table, which might violate intended security policy. This is addressed by allowing the MERGE storage engine to be disabled, which can be done by running mysqld with the '--skip-merge' option. (CVE-2006-4031)

MySQL evaluated arguments in the wrong security context, which allowed an authenticated user to gain privileges through a routine that had been made available using 'GRANT EXECUTE'. (CVE-2006-4227)

Multiple flaws in MySQL allowed an authenticated user to cause the MySQL daemon to crash via crafted SQL queries. This only caused a temporary denial of service, as the MySQL daemon is automatically restarted after the crash. (CVE-2006-7232, CVE-2007-1420, CVE-2007-2583)

As well, these updated packages fix the following bugs :

  - a separate counter was used for 'insert delayed'     statements, which caused rows to be discarded. In these     updated packages, 'insert delayed' statements no longer     use a separate counter, which resolves this issue.

  - due to a bug in the Native POSIX Thread Library, in     certain situations, 'flush tables' caused a deadlock on     tables that had a read lock. The mysqld daemon had to be     killed forcefully. Now, 'COND_refresh' has been replaced     with 'COND_global_read_lock', which resolves this issue.

  - mysqld crashed if a query for an unsigned column type     contained a negative value for a 'WHERE [column] NOT IN'     subquery.

  - in master and slave server situations, specifying 'on     duplicate key update' for 'insert' statements did not     update slave servers.

  - in the mysql client, empty strings were displayed as     'NULL'. For example, running 'insert into [table-name]     values (' ');' resulted in a 'NULL' entry being     displayed when querying the table using 'select * from     [table-name];'.

  - a bug in the optimizer code resulted in certain queries     executing much slower than expected.

  - on 64-bit PowerPC architectures, MySQL did not calculate     the thread stack size correctly, which could have caused     MySQL to crash when overly-complex queries were used.

Note: these updated packages upgrade MySQL to version 5.0.45. For a full list of bug fixes and enhancements, refer to the MySQL release notes: http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0.html

The version of MySQL installed on the remote host is earlier than 5.0.25 / 5.1.12 and thus reportedly allows a remote, authenticated user to gain privileges through a stored routine.

Updated mysql packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having low security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld), and many different client programs and libraries.

MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. (CVE-2007-3781)

A flaw was discovered in MySQL that allowed an authenticated user to gain update privileges for a table in another database, via a view that refers to the external table. (CVE-2007-3782)

MySQL did not require the 'DROP' privilege for 'RENAME TABLE' statements. An authenticated user could use this flaw to rename arbitrary tables. (CVE-2007-2691)

A flaw was discovered in the mysql_change_db function when returning from SQL SECURITY INVOKER stored routines. An authenticated user could use this flaw to gain database privileges. (CVE-2007-2692)

MySQL allowed an authenticated user to bypass logging mechanisms via SQL queries that contain the NULL character, which were not properly handled by the mysql_real_query function. (CVE-2006-0903)

MySQL allowed an authenticated user to access a table through a previously created MERGE table, even after the user's privileges were revoked from the original table, which might violate intended security policy. This is addressed by allowing the MERGE storage engine to be disabled, which can be done by running mysqld with the '--skip-merge' option. (CVE-2006-4031)

MySQL evaluated arguments in the wrong security context, which allowed an authenticated user to gain privileges through a routine that had been made available using 'GRANT EXECUTE'. (CVE-2006-4227)

Multiple flaws in MySQL allowed an authenticated user to cause the MySQL daemon to crash via crafted SQL queries. This only caused a temporary denial of service, as the MySQL daemon is automatically restarted after the crash. (CVE-2006-7232, CVE-2007-1420, CVE-2007-2583)

As well, these updated packages fix the following bugs :

* a separate counter was used for 'insert delayed' statements, which caused rows to be discarded. In these updated packages, 'insert delayed' statements no longer use a separate counter, which resolves this issue.

* due to a bug in the Native POSIX Thread Library, in certain situations, 'flush tables' caused a deadlock on tables that had a read lock. The mysqld daemon had to be killed forcefully. Now, 'COND_refresh' has been replaced with 'COND_global_read_lock', which resolves this issue.

* mysqld crashed if a query for an unsigned column type contained a negative value for a 'WHERE [column] NOT IN' subquery.

* in master and slave server situations, specifying 'on duplicate key update' for 'insert' statements did not update slave servers.

* in the mysql client, empty strings were displayed as 'NULL'. For example, running 'insert into [table-name] values (' ');' resulted in a 'NULL' entry being displayed when querying the table using 'select * from [table-name];'.

* a bug in the optimizer code resulted in certain queries executing much slower than expected.

* on 64-bit PowerPC architectures, MySQL did not calculate the thread stack size correctly, which could have caused MySQL to crash when overly-complex queries were used.

Note: these updated packages upgrade MySQL to version 5.0.45. For a full list of bug fixes and enhancements, refer to the MySQL release notes: http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0.html

All mysql users are advised to upgrade to these updated packages, which resolve these issues.

This update of mysql fixes several security vulnerabilities.
(CVE-2006-4031 / CVE-2006-4226 / CVE-2006-4227)

Dmitri Lenev discovered that arguments of setuid SQL functions were evaluated in the security context of the functions' definer instead of its caller. An authenticated user with the privilege to call such a function could exploit this to execute arbitrary statements with the privileges of the definer of that function. (CVE-2006-4227)

Peter Gulutzan reported a potentially confusing situation of the MERGE table engine. If an user creates a merge table, and the administrator later revokes privileges on the original table only (without changing the privileges on the merge table), that user still has access to the data by using the merge table. This is intended behaviour, but might be undesirable in some installations; this update introduces a new server option '--skip-merge' which disables the MERGE engine completely. (CVE-2006-4031).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of mysql fixes several security vulnerabilities.
(CVE-2006-4031,CVE-2006-4226,CVE-2006-4227)

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.9 or a version of Mac OS X 10.3 that does not have Security Update 2007-003 applied. This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

Dmitri Lenev reports a privilege escalation in MySQL. MySQL evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote and local authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

ID	Name	Product	Family	Severity
180609	Oracle Linux 5 : mysql (ELSA-2008-0364)	Nessus	Oracle Linux Local Security Checks	critical
60406	Scientific Linux Security Update : mysql on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
17808	MySQL < 5.0.25 / 5.1.12 Privilege Escalation	Nessus	Databases	medium
32425	RHEL 5 : mysql (RHSA-2008:0364)	Nessus	Red Hat Local Security Checks	medium
29524	SuSE 10 Security Update : mysql (ZYPP Patch Number 2073)	Nessus	SuSE Local Security Checks	medium
27917	Ubuntu 6.06 LTS : mysql-dfsg-5.0 vulnerabilities (USN-338-1)	Nessus	Ubuntu Local Security Checks	medium
27358	openSUSE 10 Security Update : mysql (mysql-2075)	Nessus	SuSE Local Security Checks	medium
3947	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus Network Monitor	Web Clients	high
22924	FreeBSD : mysql -- database suid privilege escalation (a9c51caf-6603-11db-ab90-000e35fd8194)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2006-4227

high

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

high

medium