Debian DSA-1997-1 : mysql-dfsg-5.0 - several vulnerabilities

High Nessus Plugin ID 44861

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 7.4

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2009-4019 Domas Mituzas discovered that mysqld does not properly handle errors during execution of certain SELECT statements with subqueries, and does not preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement.

- CVE-2009-4030 Sergei Golubchik discovered that MySQL allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified DATA DIRECTORY or INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory.

- CVE-2009-4484 Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field.

Solution

Upgrade the mysql-dfsg-5.0 packages.

For the oldstable distribution (etch), these problems have been fixed in version 5.0.32-7etch12

For the stable distribution (lenny), these problems have been fixed in version 5.0.51a-24+lenny3

See Also

https://security-tracker.debian.org/tracker/CVE-2009-4019

https://security-tracker.debian.org/tracker/CVE-2009-4030

https://security-tracker.debian.org/tracker/CVE-2009-4484

https://www.debian.org/security/2010/dsa-1997

Plugin Details

Severity: High

ID: 44861

File Name: debian_DSA-1997.nasl

Version: 1.12

Type: local

Agent: unix

Published: 2010/02/24

Updated: 2019/08/02

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 7.4

CVSS v2.0

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:mysql-dfsg-5.0, cpe:/o:debian:debian_linux:4.0, cpe:/o:debian:debian_linux:5.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/02/14

Exploitable With

Core Impact

Metasploit (MySQL yaSSL CertDecoder::GetName Buffer Overflow)

Reference Information

CVE: CVE-2009-4019, CVE-2009-4030, CVE-2009-4484

BID: 37075, 37640, 37943

DSA: 1997

CWE: 59, 119