Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mysql-dfsg-5.0 vulnerabilities (USN-588-1)

high Nessus Plugin ID 31638

Synopsis

The remote Ubuntu host is missing one or more security-related patches.

Description

Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232)

Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges.
This issue does not affect Ubuntu 7.10. (CVE-2007-2692)

Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303)

Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected packages.

See Also

https://usn.ubuntu.com/588-1/

Plugin Details

Severity: High

ID: 31638

File Name: ubuntu_USN-588-1.nasl

Version: 1.20

Type: local

Agent: unix

Published: 3/21/2008

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: E:F/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:libmysqlclient15-dev, p-cpe:/a:canonical:ubuntu_linux:libmysqlclient15off, p-cpe:/a:canonical:ubuntu_linux:mysql-client, p-cpe:/a:canonical:ubuntu_linux:mysql-client-5.0, p-cpe:/a:canonical:ubuntu_linux:mysql-common, p-cpe:/a:canonical:ubuntu_linux:mysql-server, p-cpe:/a:canonical:ubuntu_linux:mysql-server-4.1, p-cpe:/a:canonical:ubuntu_linux:mysql-server-5.0, cpe:/o:canonical:ubuntu_linux:6.06:-:lts, cpe:/o:canonical:ubuntu_linux:6.10, cpe:/o:canonical:ubuntu_linux:7.04, cpe:/o:canonical:ubuntu_linux:7.10

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/19/2008

Exploitable With

Core Impact

Metasploit (MySQL yaSSL SSL Hello Message Buffer Overflow)

Reference Information

CVE: CVE-2006-7232, CVE-2007-2692, CVE-2007-6303, CVE-2008-0226, CVE-2008-0227

BID: 24011, 26832

USN: 588-1

CWE: 89, 119