The version of MySQL Community Server installed on the remote host is earlier than 5.1.47 / 5.0.91 and is, therefore, potentially affected by the following vulnerabilities :

  - The server may continue reading packets indefinitely     if it receives a packet larger than the maximum size     of one packet, which could allow an unauthenticated,     remote attacker to consume a high level of CPU     and bandwidth. (Bug #50974)

  - Using an overly long table name argument to the     'COM_FIELD_LIST' command, an authenticated user can     overflow a buffer and execute arbitrary code on the     affected host. (Bug #53237)

  - Using a specially crafted table name argument to     'COM_FIELD_LIST', an authenticated user can bypass     almost all forms of checks for privileges and table-     level grants. (Bug #53371)

Several vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-1626     MySQL allows local users to delete the data and index     files of another user's MyISAM table via a symlink     attack in conjunction with the DROP TABLE command.

  - CVE-2010-1848     MySQL failed to check the table name argument of a     COM_FIELD_LIST command packet for validity and     compliance to acceptable table name standards. This     allows an authenticated user with SELECT privileges on     one table to obtain the field definitions of any table     in all other databases and potentially of other MySQL     instances accessible from the server's file system.

  - CVE-2010-1849     MySQL could be tricked to read packets indefinitely if     it received a packet larger than the maximum size of one     packet. This results in high CPU usage and thus denial     of service conditions.

  - CVE-2010-1850     MySQL was susceptible to a buffer-overflow attack due to     a failure to perform bounds checking on the table name     argument of a COM_FIELD_LIST command packet. By sending     long data for the table name, a buffer is overflown,     which could be exploited by an authenticated user to     inject malicious code.

Update to MySQL 5.1.47, for various fixes described at http://dev.mysql.com/doc/refman/5.1/en/news-5-1-47.html including fixes for CVE-2010-1848, CVE-2010-1849, CVE-2010-1850 In F13, also create mysql group explicitly in pre-server script, to ensure correct GID

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following bugs have been fixed :

  - local users could delete data files for tables of other     users. (CVE-2010-1626)

  - authenticated users could gather information for tables     they should not have access to. (CVE-2010-1849)

  - authenticated users could crash mysqld. (CVE-2010-1848)

  - authenticated users could potentially execute arbitrary     code as the user running mysqld. (CVE-2010-1850)

  - authenticated users could crash mysqld (CVE-2010-3677 /     CVE-2010-3678 / CVE-2010-3681 / CVE-2010-3682 /     CVE-2010-3683)

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.



Versions of MySQL server earlier than 5.1.47 / 5.0.91 are potentially affected by the following vulnerabilities :

  - The server may continue reading packets indefinitely if it receives a packet larger than the maximum size of one packet, which could allow an unauthenticated remote attacker to consume a high level of CPU and bandwidth. (Bug #50974)

  - Using an overly long table name argument to the 'COM_FIELD_LIST' command, an authenticated user can overflow a buffer and execute arbitrary code on the affected host. (Bug #53237)

  - Using a specially crafted table name argument to 'COM_FIELD_LIST', an authenticated user can bypass almost all forms of checks for privileges and table-level grants. (Bug #53371)

Versions of Mac OS X 10.6 earlier than 10.6.5 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server

  - Apache mod_perl

  - Apache

  - AppKit

  - ATS

  - CFNetwork

  - CoreGraphics

  - CoreText

  - CUPS

  - Directory Services

  - diskdev_cmds

Disk Images

  - Flash Player plug-in

  - gzip

  - Image Capture

  - ImageIO

  - Image RAW

  - Kernel

  - MySQL

  - neon

  - Networking

  - OpenLDAP

  - OpenSSL

  - Password Server

  - PHP

  - Printing

  - python

  - QuickLook

  - QuickTime

  - Safari RSS

  - Time Machine

  - Wiki Server

  - X11

  - xar

Versions of MySQL server earlier than 5.1.47 / 5.0.91 are potentially affected by the following vulnerabilities :

  - The server may continue reading packets indefinitely if it receives a packet larger than the maximum size of one packet, which could allow an unauthenticated remote attacker to consume a high level of CPU and bandwidth. (Bug #50974)

  - Using an overly long table name argument to the 'COM_FIELD_LIST' command, an authenticated user can overflow a buffer and execute arbitrary code on the affected host. (Bug #53237)

  - Using a specially crafted table name argument to 'COM_FIELD_LIST', an authenticated user can bypass almost all forms of checks for privileges and table-level grants. (Bug #53371)

ID	Name	Product	Family	Published	Updated	Severity
46702	MySQL Community Server < 5.1.47 / 5.0.91 Multiple Vulnerabilities	Nessus	Databases	5/24/2010	11/15/2018	medium
46832	Debian DSA-2057-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	6/8/2010	1/4/2021	medium
47519	Fedora 13 : mysql-5.1.47-1.fc13 (2010-9016)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
50021	SuSE 10 Security Update : MySQL (ZYPP Patch Number 7172)	Nessus	SuSE Local Security Checks	10/18/2010	1/14/2021	medium
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	3/13/2012	9/19/2019	high
5587	MySQL Community Server < 5.1.47 / 5.0.91 Multiple Vulnerabilities	Nessus Network Monitor	Database	6/29/2010	3/6/2019	medium
5705	Mac OS X 10.6 < 10.6.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	11/11/2010	3/6/2019	critical
801133	MySQL Community Server < 5.1.47 / 5.0.91 Multiple Vulnerabilities	Log Correlation Engine	Database	6/29/2010		medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

medium

critical

medium