Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mysql-dfsg-5.0 vulnerabilities (USN-588-1)

high Nessus Plugin ID 31638


The remote Ubuntu host is missing one or more security-related patches.


Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232)

Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges.
This issue does not affect Ubuntu 7.10. (CVE-2007-2692)

Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303)

Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Update the affected packages.

See Also


Plugin Details

Severity: High

ID: 31638

File Name: ubuntu_USN-588-1.nasl

Version: 1.20

Type: local

Agent: unix

Published: 3/21/2008

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent

Risk Information


Risk Factor: High

Score: 7.3


Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: E:F/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:libmysqlclient15-dev, p-cpe:/a:canonical:ubuntu_linux:libmysqlclient15off, p-cpe:/a:canonical:ubuntu_linux:mysql-client, p-cpe:/a:canonical:ubuntu_linux:mysql-client-5.0, p-cpe:/a:canonical:ubuntu_linux:mysql-common, p-cpe:/a:canonical:ubuntu_linux:mysql-server, p-cpe:/a:canonical:ubuntu_linux:mysql-server-4.1, p-cpe:/a:canonical:ubuntu_linux:mysql-server-5.0, cpe:/o:canonical:ubuntu_linux:6.06:-:lts, cpe:/o:canonical:ubuntu_linux:6.10, cpe:/o:canonical:ubuntu_linux:7.04, cpe:/o:canonical:ubuntu_linux:7.10

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/19/2008

Exploitable With

Core Impact

Metasploit (MySQL yaSSL SSL Hello Message Buffer Overflow)

Reference Information

CVE: CVE-2006-7232, CVE-2007-2692, CVE-2007-6303, CVE-2008-0226, CVE-2008-0227

BID: 24011, 26832

USN: 588-1

CWE: 89, 119