This update fixes several security issues in mysql :

  - checking server certificates (CVE-2009-4028)

  - error handling in subqueries (CVE-2009-4019)

  - preserving null_value flag in GeomFromWKB     (CVE-2009-4019)

  - symlink behavior fixed (CVE-2008-7247)

  - symlink behavior refixed (CVE-2009-4030)

It was discovered that MySQL could be made to overwrite existing table files in the data directory. An authenticated user could use the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks. This update alters table creation behaviour by disallowing the use of the MySQL data directory in DATA DIRECTORY and INDEX DIRECTORY options. This issue only affected Ubuntu 8.10. (CVE-2008-4098) 

It was discovered that MySQL contained a cross-site scripting vulnerability in the command-line client when the --html option is enabled. An attacker could place arbitrary web script or html in a database cell, which would then get placed in the html document output by the command-line tool. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04. (CVE-2008-4456)

It was discovered that MySQL could be made to overwrite existing table files in the data directory. An authenticated user could use symlinks combined with the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks. This issue only affected Ubuntu 9.10. (CVE-2008-7247)

It was discovered that MySQL contained multiple format string flaws when logging database creation and deletion. An authenticated user could use specially crafted database names to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04. (CVE-2009-2446)

It was discovered that MySQL incorrectly handled errors when performing certain SELECT statements, and did not preserve correct flags when performing statements that use the GeomFromWKB function. An authenticated user could exploit this to make MySQL crash, causing a denial of service. (CVE-2009-4019)

It was discovered that MySQL incorrectly checked symlinks when using the DATA DIRECTORY and INDEX DIRECTORY options. A local user could use symlinks to create tables that pointed to tables known to be created at a later time, bypassing access restrictions. (CVE-2009-4030)

It was discovered that MySQL contained a buffer overflow when parsing ssl certificates. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 LTS and the default compiler options for affected releases should reduce the vulnerability to a denial of service. In the default installation, attackers would also be isolated by the AppArmor MySQL profile. (CVE-2009-4484).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

Updated mysql packages fix the following bugs :

  - upstream #47320 - checking server certificates     (CVE-2009-4028)

  - upstream #48291 - error handling in subqueries     (CVE-2009-4019)

  - upstream #47780 - preserving null_value flag in     GeomFromWKB() (CVE-2009-4019)

  - upstream #39277 - symlink behaviour fixed     (CVE-2008-7247)

  - upstream #32167 - symlink behaviour refixed     (CVE-2009-4030)

ID	Name	Product	Family	Published	Updated	Severity
46220	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)	Nessus	SuSE Local Security Checks	5/4/2010	1/14/2021	medium
44585	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-897-1)	Nessus	Ubuntu Local Security Checks	2/11/2010	9/19/2019	high
46218	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)	Nessus	SuSE Local Security Checks	5/4/2010	1/14/2021	medium
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	3/13/2012	9/19/2019	high
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	3/29/2010	5/28/2024	critical
46232	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	5/5/2010	1/14/2021	medium
46229	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	5/5/2010	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

high

medium

high

critical

medium

medium