The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0109 advisory.

    - Add fixes for CVE-2009-4019, CVE-2009-4028, CVE-2009-4030     Resolves: #556505

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2009-4019 mysql: DoS (crash) when comparing GIS items from subquery and when handling subqueires in WHERE and assigning a SELECT result to a @variable

CVE-2009-4028 mysql: client SSL certificate verification flaw

CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098

It was discovered that the MySQL client ignored certain SSL certificate verification errors when connecting to servers. A man-in-the-middle attacker could use this flaw to trick MySQL clients into connecting to a spoofed MySQL server. (CVE-2009-4028)

Note: This fix may uncover previously hidden SSL configuration issues, such as incorrect CA certificates being used by clients or expired server certificates. This update should be carefully tested in deployments where SSL connections are used.

A flaw was found in the way MySQL handled SELECT statements with subqueries in the WHERE clause, that assigned results to a user variable. A remote, authenticated attacker could use this flaw to crash the MySQL server daemon (mysqld). This issue only caused a temporary denial of service, as the MySQL daemon was automatically restarted after the crash. (CVE-2009-4019)

When the 'datadir' option was configured with a relative path, MySQL did not properly check paths used as arguments for the DATA DIRECTORY and INDEX DIRECTORY directives. An authenticated attacker could use this flaw to bypass the restriction preventing the use of subdirectories of the MySQL data directory being used as DATA DIRECTORY and INDEX DIRECTORY paths. (CVE-2009-4030)

Note: Due to the security risks and previous security issues related to the use of the DATA DIRECTORY and INDEX DIRECTORY directives, users not depending on this feature should consider disabling it by adding 'symbolic-links=0' to the '[mysqld]' section of the 'my.cnf' configuration file. In this update, an example of such a configuration was added to the default 'my.cnf' file.

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201201-02 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MySQL. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may be able to execute arbitrary code       with the privileges of the MySQL process, cause a Denial of Service       condition, bypass security restrictions, uninstall arbitrary MySQL       plugins, or conduct Man-in-the-Middle and Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

Updated MySQL packages fix the following bugs :

  - upstream #47320 - checking server certificates.
    (CVE-2009-4028)

  - upstream #48291 - error handling in subqueries.
    (CVE-2009-4019)

  - upstream #47780 - preserving null_value flag in     GeomFromWKB(). (CVE-2009-4019)

  - upstream #39277 - symlink behaviour fixed.
    (CVE-2008-7247)

  - upstream #32167 - symlink behaviour refixed     (CVE-2009-4030)

This update fixes various security issues (bnc#557669) :

upstream #47320 - checking server certificates (CVE-2009-4028) upstream #48291 - error handling in subqueries (CVE-2009-4019) upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) upstream #39277 - symlink behaviour fixed (CVE-2008-7247) upstream #32167 - symlink behaviour refixed (CVE-2009-4030) fixing remote buffer overflow. (CVE-2009-4484)

Multiple vulnerabilities has been found and corrected in mysql :

mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement (CVE-2009-4019).

The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library (CVE-2009-4028).

MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079 (CVE-2009-4030).

The updated packages have been patched to correct these issues.
Additionally for 2009.1 and 2010.0 mysql has also been upgraded to the latest stable 5.1 release (5.1.42).

Updated mysql packages fix the following bugs :

  - upstream #47320 - checking server certificates     (CVE-2009-4028)

  - upstream #48291 - error handling in subqueries     (CVE-2009-4019)

  - upstream #47780 - preserving null_value flag in     GeomFromWKB() (CVE-2009-4019)

  - upstream #39277 - symlink behaviour fixed     (CVE-2008-7247)

  - upstream #32167 - symlink behaviour refixed     (CVE-2009-4030)

This update fixes several security issues in mysql :

  - checking server certificates (CVE-2009-4028)

  - error handling in subqueries (CVE-2009-4019)

  - preserving null_value flag in GeomFromWKB     (CVE-2009-4019)

  - symlink behavior fixed (CVE-2008-7247)

  - symlink behavior refixed (CVE-2009-4030)

Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

It was discovered that the MySQL client ignored certain SSL certificate verification errors when connecting to servers. A man-in-the-middle attacker could use this flaw to trick MySQL clients into connecting to a spoofed MySQL server. (CVE-2009-4028)

Note: This fix may uncover previously hidden SSL configuration issues, such as incorrect CA certificates being used by clients or expired server certificates. This update should be carefully tested in deployments where SSL connections are used.

A flaw was found in the way MySQL handled SELECT statements with subqueries in the WHERE clause, that assigned results to a user variable. A remote, authenticated attacker could use this flaw to crash the MySQL server daemon (mysqld). This issue only caused a temporary denial of service, as the MySQL daemon was automatically restarted after the crash. (CVE-2009-4019)

When the 'datadir' option was configured with a relative path, MySQL did not properly check paths used as arguments for the DATA DIRECTORY and INDEX DIRECTORY directives. An authenticated attacker could use this flaw to bypass the restriction preventing the use of subdirectories of the MySQL data directory being used as DATA DIRECTORY and INDEX DIRECTORY paths. (CVE-2009-4030)

Note: Due to the security risks and previous security issues related to the use of the DATA DIRECTORY and INDEX DIRECTORY directives, users not depending on this feature should consider disabling it by adding 'symbolic-links=0' to the '[mysqld]' section of the 'my.cnf' configuration file. In this update, an example of such a configuration was added to the default 'my.cnf' file.

All MySQL users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

Multiple vulnerabilities has been found and corrected in mysql :

mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement (CVE-2009-4019).

The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library (CVE-2009-4028).

MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079 (CVE-2009-4030).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

The updated packages have been patched to correct these issues.
Additionally for 2009.0 and MES5 mysql has also been upgraded to the last stable 5.0 release (5.0.89).

- Update to MySQL 5.1.41, for various fixes described at     http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html     including security fixes - Stop waiting during 'service     mysqld start' if mysqld_safe exits

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL 5.1 installed on the remote host is earlier than 5.1.41 and is, therefore, potentially affected by the following vulnerabilities :

  - An incomplete fix was provided in 5.1.24 for     CVE-2008-2079, a symlink-related privilege     escalation issue. (Bug #39277)

  - MySQL clients linked against OpenSSL are vulnerable     to man-in-the-middle attacks. (Bug #47320)

  - The GeomFromWKB() function can be manipulated     to cause a denial of service. (Bug #47780)

  - Specially crafted SELECT statements containing sub-     queries in the WHERE clause can cause the server     to crash. (Bug #48291)

The version of MySQL 5.0 installed on the remote host is earlier than 5.0.88. It is, therefore, potentially affected by the following vulnerabilities :

  - MySQL clients linked against OpenSSL are vulnerable     to man-in-the-middle attacks. (Bug #47320)

  - The GeomFromWKB() function can be manipulated     to cause a denial of service. (Bug #47780)

  - Specially crafted SELECT statements containing sub-     queries in the WHERE clause can cause the server     to crash. (Bug #48291)

  - It is possible to bypass access restrictions when the     data directory contains a symbolic link to a different     file system. (Bug #39277)

ID	Name	Product	Family	Severity
67997	Oracle Linux 5 : mysql (ELSA-2010-0109)	Nessus	Oracle Linux Local Security Checks	medium
60736	Scientific Linux Security Update : mysql on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57446	GLSA-201201-02 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50935	SuSE 11 Security Update : MySQL (SAT Patch Number 2317)	Nessus	SuSE Local Security Checks	medium
49903	SuSE 10 Security Update : MySQL (ZYPP Patch Number 6899)	Nessus	SuSE Local Security Checks	high
48166	Mandriva Linux Security Advisory : mysql (MDVSA-2010:012)	Nessus	Mandriva Local Security Checks	medium
46235	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	medium
46232	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	medium
46229	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	medium
46220	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)	Nessus	SuSE Local Security Checks	medium
46219	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)	Nessus	SuSE Local Security Checks	medium
46218	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)	Nessus	SuSE Local Security Checks	medium
45107	SuSE 10 Security Update : MySQL (ZYPP Patch Number 6897)	Nessus	SuSE Local Security Checks	high
44948	CentOS 5 : mysql (CESA-2010:0109)	Nessus	CentOS Local Security Checks	medium
44634	RHEL 5 : mysql (RHSA-2010:0109)	Nessus	Red Hat Local Security Checks	medium
44043	Mandriva Linux Security Advisory : mysql (MDVSA-2010:011)	Nessus	Mandriva Local Security Checks	medium
43375	Fedora 11 : mysql-5.1.41-2.fc11 (2009-13504)	Nessus	Fedora Local Security Checks	medium
43374	Fedora 12 : mysql-5.1.41-2.fc12 (2009-13466)	Nessus	Fedora Local Security Checks	medium
42900	MySQL 5.1 < 5.1.41 Multiple Vulnerabilities	Nessus	Databases	medium
42899	MySQL 5.0 < 5.0.88 Multiple Vulnerabilities	Nessus	Databases	medium

Detections

Analytics

CVE-2009-4028

medium

Tenable Plugins

medium

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium