MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a CREATE TABLE LIKE statement, which allows remote authenticated users to obtain sensitive information such as the table structure.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0364 advisory.

  - sql_select.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to     cause a denial of service (crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table, as     originally demonstrated using ORDER BY. (CVE-2006-7232)

  - MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing     information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain     structure elements from being initialized and triggers a NULL dereference in the filesort function.
    (CVE-2007-1420)

  - The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows     context-dependent attackers to cause a denial of service (crash) via a crafted IF clause that results in a     divide-by-zero error and a NULL pointer dereference. (CVE-2007-2583)

  - MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for     RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.
    (CVE-2007-2691)

  - The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore     THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote     authenticated users to gain privileges. (CVE-2007-2692)

  - MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a     CREATE TABLE LIKE statement, which allows remote authenticated users to obtain sensitive information such     as the table structure. (CVE-2007-3781)

  - MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a     table in another database via a view that refers to this external table. (CVE-2007-3782)

  - MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the     NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was     originally reported for the mysql_query function, but the vendor states that since mysql_query expects a     null character, this is not an issue for mysql_query. (CVE-2006-0903)

  - MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously     created MERGE table, even after the user's privileges are revoked for the original table, which might     violate intended security policy. (CVE-2006-4031)

  - MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of     the routine's definer instead of the routine's caller, which allows remote authenticated users to gain     privileges through a routine that has been made available using GRANT EXECUTE. (CVE-2006-4227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. (CVE-2007-3781)

A flaw was discovered in MySQL that allowed an authenticated user to gain update privileges for a table in another database, via a view that refers to the external table. (CVE-2007-3782)

MySQL did not require the 'DROP' privilege for 'RENAME TABLE' statements. An authenticated user could use this flaw to rename arbitrary tables. (CVE-2007-2691)

A flaw was discovered in the mysql_change_db function when returning from SQL SECURITY INVOKER stored routines. An authenticated user could use this flaw to gain database privileges. (CVE-2007-2692)

MySQL allowed an authenticated user to bypass logging mechanisms via SQL queries that contain the NULL character, which were not properly handled by the mysql_real_query function. (CVE-2006-0903)

MySQL allowed an authenticated user to access a table through a previously created MERGE table, even after the user's privileges were revoked from the original table, which might violate intended security policy. This is addressed by allowing the MERGE storage engine to be disabled, which can be done by running mysqld with the '--skip-merge' option. (CVE-2006-4031)

MySQL evaluated arguments in the wrong security context, which allowed an authenticated user to gain privileges through a routine that had been made available using 'GRANT EXECUTE'. (CVE-2006-4227)

Multiple flaws in MySQL allowed an authenticated user to cause the MySQL daemon to crash via crafted SQL queries. This only caused a temporary denial of service, as the MySQL daemon is automatically restarted after the crash. (CVE-2006-7232, CVE-2007-1420, CVE-2007-2583)

As well, these updated packages fix the following bugs :

  - a separate counter was used for 'insert delayed'     statements, which caused rows to be discarded. In these     updated packages, 'insert delayed' statements no longer     use a separate counter, which resolves this issue.

  - due to a bug in the Native POSIX Thread Library, in     certain situations, 'flush tables' caused a deadlock on     tables that had a read lock. The mysqld daemon had to be     killed forcefully. Now, 'COND_refresh' has been replaced     with 'COND_global_read_lock', which resolves this issue.

  - mysqld crashed if a query for an unsigned column type     contained a negative value for a 'WHERE [column] NOT IN'     subquery.

  - in master and slave server situations, specifying 'on     duplicate key update' for 'insert' statements did not     update slave servers.

  - in the mysql client, empty strings were displayed as     'NULL'. For example, running 'insert into [table-name]     values (' ');' resulted in a 'NULL' entry being     displayed when querying the table using 'select * from     [table-name];'.

  - a bug in the optimizer code resulted in certain queries     executing much slower than expected.

  - on 64-bit PowerPC architectures, MySQL did not calculate     the thread stack size correctly, which could have caused     MySQL to crash when overly-complex queries were used.

Note: these updated packages upgrade MySQL to version 5.0.45. For a full list of bug fixes and enhancements, refer to the MySQL release notes: http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0.html

Updated mysql packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having low security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld), and many different client programs and libraries.

MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. (CVE-2007-3781)

A flaw was discovered in MySQL that allowed an authenticated user to gain update privileges for a table in another database, via a view that refers to the external table. (CVE-2007-3782)

MySQL did not require the 'DROP' privilege for 'RENAME TABLE' statements. An authenticated user could use this flaw to rename arbitrary tables. (CVE-2007-2691)

A flaw was discovered in the mysql_change_db function when returning from SQL SECURITY INVOKER stored routines. An authenticated user could use this flaw to gain database privileges. (CVE-2007-2692)

MySQL allowed an authenticated user to bypass logging mechanisms via SQL queries that contain the NULL character, which were not properly handled by the mysql_real_query function. (CVE-2006-0903)

MySQL allowed an authenticated user to access a table through a previously created MERGE table, even after the user's privileges were revoked from the original table, which might violate intended security policy. This is addressed by allowing the MERGE storage engine to be disabled, which can be done by running mysqld with the '--skip-merge' option. (CVE-2006-4031)

MySQL evaluated arguments in the wrong security context, which allowed an authenticated user to gain privileges through a routine that had been made available using 'GRANT EXECUTE'. (CVE-2006-4227)

Multiple flaws in MySQL allowed an authenticated user to cause the MySQL daemon to crash via crafted SQL queries. This only caused a temporary denial of service, as the MySQL daemon is automatically restarted after the crash. (CVE-2006-7232, CVE-2007-1420, CVE-2007-2583)

As well, these updated packages fix the following bugs :

* a separate counter was used for 'insert delayed' statements, which caused rows to be discarded. In these updated packages, 'insert delayed' statements no longer use a separate counter, which resolves this issue.

* due to a bug in the Native POSIX Thread Library, in certain situations, 'flush tables' caused a deadlock on tables that had a read lock. The mysqld daemon had to be killed forcefully. Now, 'COND_refresh' has been replaced with 'COND_global_read_lock', which resolves this issue.

* mysqld crashed if a query for an unsigned column type contained a negative value for a 'WHERE [column] NOT IN' subquery.

* in master and slave server situations, specifying 'on duplicate key update' for 'insert' statements did not update slave servers.

* in the mysql client, empty strings were displayed as 'NULL'. For example, running 'insert into [table-name] values (' ');' resulted in a 'NULL' entry being displayed when querying the table using 'select * from [table-name];'.

* a bug in the optimizer code resulted in certain queries executing much slower than expected.

* on 64-bit PowerPC architectures, MySQL did not calculate the thread stack size correctly, which could have caused MySQL to crash when overly-complex queries were used.

Note: these updated packages upgrade MySQL to version 5.0.45. For a full list of bug fixes and enhancements, refer to the MySQL release notes: http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0.html

All mysql users are advised to upgrade to these updated packages, which resolve these issues.

Several local/remote vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3781     It was discovered that the privilege validation for the     source table of CREATE TABLE LIKE statements was     insufficiently enforced, which might lead to information     disclosure. This is only exploitable by authenticated     users.

  - CVE-2007-5969     It was discovered that symbolic links were handled     insecurely during the creation of tables with DATA     DIRECTORY or INDEX DIRECTORY statements, which might     lead to denial of service by overwriting data. This is     only exploitable by authenticated users.

  - CVE-2007-6304     It was discovered that queries to data in a FEDERATED     table can lead to a crash of the local database server,     if the remote server returns information with less     columns than expected, resulting in denial of service.

Joe Gallo and Artem Russakovskii discovered that the InnoDB engine in MySQL did not properly perform input validation. An authenticated user could use a crafted CONTAINS statement to cause a denial of service.
(CVE-2007-5925)

It was discovered that under certain conditions MySQL could be made to overwrite system table information. An authenticated user could use a crafted RENAME statement to escalate privileges. (CVE-2007-5969)

Philip Stoev discovered that the the federated engine of MySQL did not properly handle responses with a small number of columns. An authenticated user could use a crafted response to a SHOW TABLE STATUS query and cause a denial of service. (CVE-2007-6304)

It was discovered that MySQL did not properly enforce access controls.
An authenticated user could use a crafted CREATE TABLE LIKE statement to escalate privileges. (CVE-2007-3781).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New mysql packages are available for Slackware 11.0, 12.0, and
-current to fix bugs and security issues.

This update provides fixes for :

  - remote triggerable crash. (CVE-2007-3780)

  - query tables without propper authorisation.
    (CVE-2007-3781)

  - gain update privileges without propper authorisation.
    (CVE-2007-3782)

A vulnerability in MySQL prior to 5.0.45 did not require priveliges such as SELECT for the source table in a CREATE TABLE LIKE statement, allowing remote authenticated users to obtain sensitive information such as the table structure (CVE-2007-3781).

A vulnerability in the InnoDB engine in MySQL allowed remote authenticated users to cause a denial of service (database crash) via certain CONTAINS operations on an indexed column, which triggered an assertion error (CVE-2007-5925).

Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options could be used to overwrite system table information by replacing the file to which a symlink pointed to (CVE-2007-5969).

The updated packages have been patched to correct these issues.

This update provides fixes for :

  - CVE-2007-3780: remote triggerable crash

  - CVE-2007-3781: query tables without propper     authorisation

  - CVE-2007-3782: gain update privileges without propper     authorisation

The remote host is affected by the vulnerability described in GLSA-200708-10 (MySQL: Denial of Service and information leakage)

    Dormando reported a vulnerability within the handling of password     packets in the connection protocol (CVE-2007-3780). Andrei Elkin also     found that the 'CREATE TABLE LIKE' command didn't require SELECT     privileges on the source table (CVE-2007-3781).
  Impact :

    A remote unauthenticated attacker could use the first vulnerability to     make the server crash. The second vulnerability can be used by     authenticated users to obtain information on tables they are not     normally able to access.
  Workaround :

    There is no known workaround at this time.

The version of MySQL installed on the remote host is reportedly affected by a denial of service vulnerability that can lead to a server crash with a specially-crafted password packet.  It is also affected by a privilege escalation vulnerability because 'CREATE TABLE LIKE' does not require any privileges on the source table, which allows an attacker to create arbitrary tables using the affected application.

The version of MySQL Community Server installed on the remote host is reportedly affected by a denial of service vulnerability that can lead to a server crash with a specially crafted password packet. 

It is also affected by a privilege escalation vulnerability because 'CREATE TABLE LIKE' does not require any privileges on the source table, which allows an attacker to create arbitrary tables using the affected application.

ID	Name	Product	Family	Severity
180609	Oracle Linux 5 : mysql (ELSA-2008-0364)	Nessus	Oracle Linux Local Security Checks	critical
60406	Scientific Linux Security Update : mysql on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
32425	RHEL 5 : mysql (RHSA-2008:0364)	Nessus	Red Hat Local Security Checks	medium
29860	Debian DSA-1451-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	high
29793	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mysql-dfsg-5.0 vulnerabilities (USN-559-1)	Nessus	Ubuntu Local Security Checks	high
29704	Slackware 11.0 / 12.0 / current : mysql (SSA:2007-348-01)	Nessus	Slackware Local Security Checks	high
29525	SuSE 10 Security Update : MySQL (ZYPP Patch Number 4376)	Nessus	SuSE Local Security Checks	medium
29300	Mandrake Linux Security Advisory : MySQL (MDKSA-2007:243)	Nessus	Mandriva Local Security Checks	high
27359	openSUSE 10 Security Update : mysql (mysql-4375)	Nessus	SuSE Local Security Checks	medium
25916	GLSA-200708-10 : MySQL: Denial of Service and information leakage	Nessus	Gentoo Local Security Checks	medium
4146	Oracle MySQL < 5.0.45 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
25759	MySQL Community Server 5.0 < 5.0.45 Multiple Vulnerabilities	Nessus	Databases	medium
801122	MySQL < 5.0.45 Multiple Vulnerabilities	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2007-3781

medium

Tenable Plugins

critical

medium

medium

high

high

high

medium

high

medium

medium

medium

medium

medium