MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0364 advisory.

  - sql_select.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to     cause a denial of service (crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table, as     originally demonstrated using ORDER BY. (CVE-2006-7232)

  - MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing     information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain     structure elements from being initialized and triggers a NULL dereference in the filesort function.
    (CVE-2007-1420)

  - The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows     context-dependent attackers to cause a denial of service (crash) via a crafted IF clause that results in a     divide-by-zero error and a NULL pointer dereference. (CVE-2007-2583)

  - MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for     RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.
    (CVE-2007-2691)

  - The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore     THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote     authenticated users to gain privileges. (CVE-2007-2692)

  - MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a     CREATE TABLE LIKE statement, which allows remote authenticated users to obtain sensitive information such     as the table structure. (CVE-2007-3781)

  - MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a     table in another database via a view that refers to this external table. (CVE-2007-3782)

  - MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the     NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was     originally reported for the mysql_query function, but the vendor states that since mysql_query expects a     null character, this is not an issue for mysql_query. (CVE-2006-0903)

  - MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously     created MERGE table, even after the user's privileges are revoked for the original table, which might     violate intended security policy. (CVE-2006-4031)

  - MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of     the routine's definer instead of the routine's caller, which allows remote authenticated users to gain     privileges through a routine that has been made available using GRANT EXECUTE. (CVE-2006-4227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. (CVE-2007-3781)

A flaw was discovered in MySQL that allowed an authenticated user to gain update privileges for a table in another database, via a view that refers to the external table. (CVE-2007-3782)

MySQL did not require the 'DROP' privilege for 'RENAME TABLE' statements. An authenticated user could use this flaw to rename arbitrary tables. (CVE-2007-2691)

A flaw was discovered in the mysql_change_db function when returning from SQL SECURITY INVOKER stored routines. An authenticated user could use this flaw to gain database privileges. (CVE-2007-2692)

MySQL allowed an authenticated user to bypass logging mechanisms via SQL queries that contain the NULL character, which were not properly handled by the mysql_real_query function. (CVE-2006-0903)

MySQL allowed an authenticated user to access a table through a previously created MERGE table, even after the user's privileges were revoked from the original table, which might violate intended security policy. This is addressed by allowing the MERGE storage engine to be disabled, which can be done by running mysqld with the '--skip-merge' option. (CVE-2006-4031)

MySQL evaluated arguments in the wrong security context, which allowed an authenticated user to gain privileges through a routine that had been made available using 'GRANT EXECUTE'. (CVE-2006-4227)

Multiple flaws in MySQL allowed an authenticated user to cause the MySQL daemon to crash via crafted SQL queries. This only caused a temporary denial of service, as the MySQL daemon is automatically restarted after the crash. (CVE-2006-7232, CVE-2007-1420, CVE-2007-2583)

As well, these updated packages fix the following bugs :

  - a separate counter was used for 'insert delayed'     statements, which caused rows to be discarded. In these     updated packages, 'insert delayed' statements no longer     use a separate counter, which resolves this issue.

  - due to a bug in the Native POSIX Thread Library, in     certain situations, 'flush tables' caused a deadlock on     tables that had a read lock. The mysqld daemon had to be     killed forcefully. Now, 'COND_refresh' has been replaced     with 'COND_global_read_lock', which resolves this issue.

  - mysqld crashed if a query for an unsigned column type     contained a negative value for a 'WHERE [column] NOT IN'     subquery.

  - in master and slave server situations, specifying 'on     duplicate key update' for 'insert' statements did not     update slave servers.

  - in the mysql client, empty strings were displayed as     'NULL'. For example, running 'insert into [table-name]     values (' ');' resulted in a 'NULL' entry being     displayed when querying the table using 'select * from     [table-name];'.

  - a bug in the optimizer code resulted in certain queries     executing much slower than expected.

  - on 64-bit PowerPC architectures, MySQL did not calculate     the thread stack size correctly, which could have caused     MySQL to crash when overly-complex queries were used.

Note: these updated packages upgrade MySQL to version 5.0.45. For a full list of bug fixes and enhancements, refer to the MySQL release notes: http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0.html

The version of MySQL installed on the remote host is earlier than 5.0.36 and thus reportedly allows a local user to cause a denial of service.

Updated mysql packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having low security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld), and many different client programs and libraries.

MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. (CVE-2007-3781)

A flaw was discovered in MySQL that allowed an authenticated user to gain update privileges for a table in another database, via a view that refers to the external table. (CVE-2007-3782)

MySQL did not require the 'DROP' privilege for 'RENAME TABLE' statements. An authenticated user could use this flaw to rename arbitrary tables. (CVE-2007-2691)

A flaw was discovered in the mysql_change_db function when returning from SQL SECURITY INVOKER stored routines. An authenticated user could use this flaw to gain database privileges. (CVE-2007-2692)

MySQL allowed an authenticated user to bypass logging mechanisms via SQL queries that contain the NULL character, which were not properly handled by the mysql_real_query function. (CVE-2006-0903)

MySQL allowed an authenticated user to access a table through a previously created MERGE table, even after the user's privileges were revoked from the original table, which might violate intended security policy. This is addressed by allowing the MERGE storage engine to be disabled, which can be done by running mysqld with the '--skip-merge' option. (CVE-2006-4031)

MySQL evaluated arguments in the wrong security context, which allowed an authenticated user to gain privileges through a routine that had been made available using 'GRANT EXECUTE'. (CVE-2006-4227)

Multiple flaws in MySQL allowed an authenticated user to cause the MySQL daemon to crash via crafted SQL queries. This only caused a temporary denial of service, as the MySQL daemon is automatically restarted after the crash. (CVE-2006-7232, CVE-2007-1420, CVE-2007-2583)

As well, these updated packages fix the following bugs :

* a separate counter was used for 'insert delayed' statements, which caused rows to be discarded. In these updated packages, 'insert delayed' statements no longer use a separate counter, which resolves this issue.

* due to a bug in the Native POSIX Thread Library, in certain situations, 'flush tables' caused a deadlock on tables that had a read lock. The mysqld daemon had to be killed forcefully. Now, 'COND_refresh' has been replaced with 'COND_global_read_lock', which resolves this issue.

* mysqld crashed if a query for an unsigned column type contained a negative value for a 'WHERE [column] NOT IN' subquery.

* in master and slave server situations, specifying 'on duplicate key update' for 'insert' statements did not update slave servers.

* in the mysql client, empty strings were displayed as 'NULL'. For example, running 'insert into [table-name] values (' ');' resulted in a 'NULL' entry being displayed when querying the table using 'select * from [table-name];'.

* a bug in the optimizer code resulted in certain queries executing much slower than expected.

* on 64-bit PowerPC architectures, MySQL did not calculate the thread stack size correctly, which could have caused MySQL to crash when overly-complex queries were used.

Note: these updated packages upgrade MySQL to version 5.0.45. For a full list of bug fixes and enhancements, refer to the MySQL release notes: http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0.html

All mysql users are advised to upgrade to these updated packages, which resolve these issues.

Stefan Streichbier and B. Mueller of SEC Consult discovered that MySQL subselect queries using 'ORDER BY' could be made to crash the MySQL server. An attacker with access to a MySQL instance could cause an intermitant denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function. This issue does not affect MySQL 5.0.37 in Mandriva Linux 2007.1. (CVE-2007-1420)

The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-dependent attackers to cause a denial of service (crash) via a crafted IF clause that results in a divide-by-zero error and a NULL pointer dereference.
(CVE-2007-2583)

MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.
(CVE-2007-2691)

Updated packages have been patched to prevent the above issues.

The remote host is affected by the vulnerability described in GLSA-200705-11 (MySQL: Two Denial of Service vulnerabilities)

    mu-b discovered a NULL pointer dereference in item_cmpfunc.cc when     processing certain types of SQL requests. Sec Consult also discovered     another NULL pointer dereference when sorting certain types of queries     on the database metadata.
  Impact :

    In both cases, a remote attacker could send a specially crafted SQL     request to the server, possibly resulting in a server crash. Note that     the attacker needs the ability to execute SELECT queries.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of MySQL on the remote host is older than 5.0.37. Such versions are vulnerable to a remote denial of service when processing certain single row subselect queries. A malicious user can crash the service via a specially crafted SQL query.

ID	Name	Product	Family	Severity
180609	Oracle Linux 5 : mysql (ELSA-2008-0364)	Nessus	Oracle Linux Local Security Checks	critical
60406	Scientific Linux Security Update : mysql on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
17803	MySQL < 5.0.36 Denial of Service	Nessus	Databases	low
32425	RHEL 5 : mysql (RHSA-2008:0364)	Nessus	Red Hat Local Security Checks	medium
28037	Ubuntu 6.06 LTS / 6.10 : mysql-dfsg-5.0 vulnerability (USN-440-1)	Nessus	Ubuntu Local Security Checks	low
25669	Mandrake Linux Security Advisory : MySQL (MDKSA-2007:139)	Nessus	Mandriva Local Security Checks	medium
25188	GLSA-200705-11 : MySQL: Two Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	low
24905	MySQL Single Row Subselect Remote DoS	Nessus	Databases	low

Detections

Analytics

CVE-2007-1420

medium

Tenable Plugins

critical

medium

low

medium

low

medium

low

low