MySQL Community Server 5.0.x before 5.0.51, Enterprise Server 5.0.x before 5.0.52, Server 5.1.x before 5.1.23, and Server 6.0.x before 6.0.4, when a table relies on symlinks created through explicit DATA DIRECTORY and INDEX DIRECTORY options, allows remote authenticated users to overwrite system table information and gain privileges via a RENAME TABLE statement that changes the symlink to point to an existing file.

Information about these advisories is available at the following locations :

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-1155 advisory.

    [4.1.20-3.RHEL4.1.el4_6.1]
     - Back-port upstream fixes for CVE-2007-5925, CVE-2007-5969.
     Resolves: #422181

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in a way MySQL handled symbolic links when database tables were created with explicit 'DATA' and 'INDEX DIRECTORY' options. An authenticated user could create a table that would overwrite tables in other databases, causing destruction of data or allowing the user to elevate privileges. (CVE-2007-5969)

A flaw was found in a way MySQL's InnoDB engine handled spatial indexes. An authenticated user could create a table with spatial indexes, which are not supported by the InnoDB engine, that would cause the mysql daemon to crash when used. This issue only causes a temporary denial of service, as the mysql daemon will be automatically restarted after the crash. (CVE-2007-5925)

This update fixes several security vulnerabilities (note: not all versions are affected by every bug) :

  - CVE-2007-2583

  - CVE-2007-2691

  - CVE-2007-2692

  - CVE-2007-5925

  - CVE-2007-5969

  - CVE-2007-6303

  - CVE-2007-6304

MySQL reports :

Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information by replacing the symbolic link points. the file to which the symlink points.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-007 applied. 

This security update contains fixes for the following products :

  - Apache
  - Certificates
  - ClamAV
  - ColorSync
  - CUPS
  - Finder
  - launchd
  - libxslt
  - MySQL Server
  - Networking
  - PHP
  - Postfix
  - PSNormalizer
  - QuickLook
  - rlogin
  - Script Editor
  - Single Sign-On
  - Tomcat
  - vim
  - Weblog

The version of MySQL Community Server 5.0 installed on the remote host is before 5.0.66.  Such versions are reportedly affected by the following issues :

  - When using a FEDERATED table, a local server could be     forced to crash if the remote server returns a result     with fewer columns than expected (Bug #29801).

  - ALTER VIEW retains the original DEFINER value, even     when altered by another user, which could allow that     user to gain the access rights of the view (Bug     #29908).

  - A local user can circumvent privileges through creation     of MyISAM tables using the 'DATA DIRECTORY' and 'INDEX     DIRECTORY' options to overwrite existing table files in     the application's data directory (Bug #32167). 

  - RENAME TABLE against a table with DATA/INDEX DIRECTORY     overwrites the file to which the symlink points (Bug     #32111).

  - It was possible to force an error message of excessive     length, which could lead to a buffer overflow (Bug     #32707).
 
  - Three vulnerabilities in yaSSL versions 1.7.5 and     earlier as used in MySQL could allow an unauthenticated     remote attacker to crash the server or to execute     arbitrary code provided yaSSL is enabled and the server     allows TCP connections (Bug #33814).

  - An empty bit-string literal (b'') used in a SQL statement     could result in a server crash (Bug #35658).

The remote host is affected by the vulnerability described in GLSA-200804-04 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in MySQL:
    Mattias Jonsson reported that a 'RENAME TABLE' command against a     table with explicit 'DATA DIRECTORY' and 'INDEX DIRECTORY' options     would overwrite the file to which the symlink points     (CVE-2007-5969).
    Martin Friebe discovered that MySQL does not     update the DEFINER value of a view when the view is altered     (CVE-2007-6303).
    Philip Stoev discovered that the federated     engine expects the response of a remote MySQL server to contain a     minimum number of columns in query replies (CVE-2007-6304).
  Impact :

    An authenticated remote attacker could exploit the first vulnerability     to overwrite MySQL system tables and escalate privileges, or use the     second vulnerability to gain privileges via an 'ALTER VIEW' statement.
    Remote federated MySQL servers could cause a Denial of Service in the     local MySQL server by exploiting the third vulnerability.
  Workaround :

    There is no known workaround at this time.

This update fixes several security vulnerabilities (note: not all versions are affected by every bug) :

  - CVE-2007-2583 

  - CVE-2007-2691 

  - CVE-2007-2692 

  - CVE-2007-5925 

  - CVE-2007-5969 

  - CVE-2007-6303 

  - CVE-2007-6304

Several local/remote vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3781     It was discovered that the privilege validation for the     source table of CREATE TABLE LIKE statements was     insufficiently enforced, which might lead to information     disclosure. This is only exploitable by authenticated     users.

  - CVE-2007-5969     It was discovered that symbolic links were handled     insecurely during the creation of tables with DATA     DIRECTORY or INDEX DIRECTORY statements, which might     lead to denial of service by overwriting data. This is     only exploitable by authenticated users.

  - CVE-2007-6304     It was discovered that queries to data in a FEDERATED     table can lead to a crash of the local database server,     if the remote server returns information with less     columns than expected, resulting in denial of service.

Joe Gallo and Artem Russakovskii discovered that the InnoDB engine in MySQL did not properly perform input validation. An authenticated user could use a crafted CONTAINS statement to cause a denial of service.
(CVE-2007-5925)

It was discovered that under certain conditions MySQL could be made to overwrite system table information. An authenticated user could use a crafted RENAME statement to escalate privileges. (CVE-2007-5969)

Philip Stoev discovered that the the federated engine of MySQL did not properly handle responses with a small number of columns. An authenticated user could use a crafted response to a SHOW TABLE STATUS query and cause a denial of service. (CVE-2007-6304)

It was discovered that MySQL did not properly enforce access controls.
An authenticated user could use a crafted CREATE TABLE LIKE statement to escalate privileges. (CVE-2007-3781).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-1157.

Updated mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld), and many different client programs and libraries.

A flaw was found in a way MySQL handled symbolic links when database tables were created with explicit 'DATA' and 'INDEX DIRECTORY' options. An authenticated user could create a table that would overwrite tables in other databases, causing destruction of data or allowing the user to elevate privileges. (CVE-2007-5969)

A flaw was found in a way MySQL's InnoDB engine handled spatial indexes. An authenticated user could create a table with spatial indexes, which are not supported by the InnoDB engine, that would cause the mysql daemon to crash when used. This issue only causes a temporary denial of service, as the mysql daemon will be automatically restarted after the crash. (CVE-2007-5925)

All mysql users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

- Thu Dec 13 2007 Tom Lane <tgl at redhat.com> 5.0.45-6

    - Back-port upstream fixes for CVE-2007-5925,       CVE-2007-5969, CVE-2007-6303. Related: #422211

  - Update License tag to match code.

    - Sun Jul 22 2007 Tom Lane <tgl at redhat.com> 5.0.45-1

    - Update to MySQL 5.0.45 Resolves: #246535

  - Move mysql_config's man page to base package Resolves:
    #245770

  - move my_print_defaults to base RPM, for consistency with     Stacks packaging

    - mysql user is no longer deleted at RPM uninstall       Resolves: #241912

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Dec 13 2007 Tom Lane <tgl at redhat.com> 5.0.45-6

    - Back-port upstream fixes for CVE-2007-5925,       CVE-2007-5969, CVE-2007-6303. Related: #422211

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New mysql packages are available for Slackware 11.0, 12.0, and
-current to fix bugs and security issues.

The version of MySQL Server installed on the remote host reportedly is affected by the following issues :

 - It is possible, by creating a partitioned table using the DATA DIRECTORY and INDEX DIRECTORY options, to gain privileges on other tables having the same name as the partitioned table. (Bug #32091)

 - Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information. (Bug #32111).

 - ALTER VIEW retains the original DEFINER value, even when altered by another user, which can allow that user to gain the access rights of the view. (Bug #29908)

 - When using a FEDERATED table, the local server can be forced to crash if the remote server returns a result with fewer columns than expected. (Bug #29801)

The version of MySQL Enterprise Server installed on the remote host reportedly is affected by the following issues :

 - Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information. (Bug #32111).

 - ALTER VIEW retained the original DEFINER value, even when altered by another user, which could allow that user to gain the access rights of the view. (Bug #29908)

 - When using a FEDERATED table, the local server can be forced to crash if the remote server returns a result with fewer columns than expected. (Bug #29801)

The version of MySQL Enterprise Server 5.0 installed on the remote host is earlier than 5.0.52.  Such versions reportedly are affected by the following issues :

  - Using RENAME TABLE against a table with explicit DATA     DIRECTORY and INDEX DIRECTORY options can be used to     overwrite system table information. (Bug #32111).

  - ALTER VIEW retained the original DEFINER value, even     when altered by another user, which could allow that     user to gain the access rights of the view. (Bug     #29908)

  - When using a FEDERATED table, the local server can be     forced to crash if the remote server returns a result     with fewer columns than expected. (Bug #29801)

The version of MySQL Server installed on the remote host reportedly is affected by the following issues :

  - It is possible, by creating a partitioned table using     the DATA DIRECTORY and INDEX DIRECTORY options, to gain     privileges on other tables having the same name as the     partitioned table. (Bug #32091)

  - Using RENAME TABLE against a table with explicit DATA     DIRECTORY and INDEX DIRECTORY options can be used to     overwrite system table information. (Bug #32111).

  - ALTER VIEW retains the original DEFINER value, even     when altered by another user, which can allow that     user to gain the access rights of the view. (Bug     #29908)

  - When using a FEDERATED table, the local server can be     forced to crash if the remote server returns a result     with fewer columns than expected. (Bug #29801)

A vulnerability in MySQL prior to 5.0.45 did not require priveliges such as SELECT for the source table in a CREATE TABLE LIKE statement, allowing remote authenticated users to obtain sensitive information such as the table structure (CVE-2007-3781).

A vulnerability in the InnoDB engine in MySQL allowed remote authenticated users to cause a denial of service (database crash) via certain CONTAINS operations on an indexed column, which triggered an assertion error (CVE-2007-5925).

Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options could be used to overwrite system table information by replacing the file to which a symlink pointed to (CVE-2007-5969).

The updated packages have been patched to correct these issues.

The version of MySQL Community Server installed on the remote host reportedly fails to check whether a file to which a symlink points exists when using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options.  A local attacker may be able to leverage this issue to overwrite system table information by replacing the file to which the symlink points.

 The version of MySQL installed on the remote host reportedly fails to check whether a file to which a symlink points exists when using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options.  A local attacker may be able to leverage this issue to overwrite system table information by replacing the file to which the symlink points.

ID	Name	Product	Family	Severity
78218	F5 Networks BIG-IP : MySQL vulnerabilities (SOL8178)	Nessus	F5 Networks Local Security Checks	high
67624	Oracle Linux 5 : Important: / mysql (ELSA-2007-1155)	Nessus	Oracle Linux Local Security Checks	medium
60332	Scientific Linux Security Update : mysql on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
41184	SuSE9 Security Update : MySQL (YOU Patch Number 12044)	Nessus	SuSE Local Security Checks	high
35339	FreeBSD : mysql -- privilege escalation and overwrite of the system table information (8c451386-dff3-11dd-a765-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
34374	Mac OS X Multiple Vulnerabilities (Security Update 2008-007)	Nessus	MacOS X Local Security Checks	critical
34159	MySQL Community Server 5.0 < 5.0.67 Multiple Vulnerabilities	Nessus	Databases	high
31835	GLSA-200804-04 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
30182	SuSE 10 Security Update : MySQL (ZYPP Patch Number 4879)	Nessus	SuSE Local Security Checks	high
30180	openSUSE 10 Security Update : libmysqlclient-devel (libmysqlclient-devel-4873)	Nessus	SuSE Local Security Checks	high
29860	Debian DSA-1451-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	high
29793	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mysql-dfsg-5.0 vulnerabilities (USN-559-1)	Nessus	Ubuntu Local Security Checks	high
29752	CentOS 4 : mysql (CESA-2007:1222-001)	Nessus	CentOS Local Security Checks	high
29737	RHEL 4 / 5 : mysql (RHSA-2007:1155)	Nessus	Red Hat Local Security Checks	high
29731	CentOS 4 / 5 : mysql (CESA-2007:1155)	Nessus	CentOS Local Security Checks	high
29714	Fedora 7 : mysql-5.0.45-6.fc7 (2007-4471)	Nessus	Fedora Local Security Checks	high
29712	Fedora 8 : mysql-5.0.45-6.fc8 (2007-4465)	Nessus	Fedora Local Security Checks	high
29704	Slackware 11.0 / 12.0 / current : mysql (SSA:2007-348-01)	Nessus	Slackware Local Security Checks	high
4313	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
4312	Oracle MySQL Enterprise Server < 5.0.52 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
29346	MySQL Enterprise Server 5.0 < 5.0.52 Multiple Vulnerabilities	Nessus	Databases	medium
29345	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus	Databases	medium
29300	Mandrake Linux Security Advisory : MySQL (MDKSA-2007:243)	Nessus	Mandriva Local Security Checks	high
29251	MySQL Community Server 5.0 < 5.0.51 RENAME TABLE Symlink System Table Overwrite	Nessus	Databases	high
4309	Oracle MySQL < 5.0.51 RENAME TABLE Symlink System Table Overwrite	Nessus Network Monitor	Database	high

Detections

Analytics

CVE-2007-5969

high

Tenable Plugins

high

medium

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

medium

medium

high

high

high