在 MySQL 資料庫伺服器中發現數個問題。已透過將 MySQL 升級至新上游版本 5.5.33 解決這些弱點，新上游版本包括額外變更，如效能改善、錯誤修正、新功能和可能不相容的變更。如需進一步的詳細資料，請參閱 MySQL 5.5 版本資訊：

- http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html
 - http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-33.html

此外，此更新可修正兩個會特別影響 mysql-5.5 Debian 套件的問題：

mysql-server-5.5 套件的後續安裝指令碼中有一個爭用情形，其在尚未限制權限之前，就會建立具有任何人皆可讀取之權限的組態檔 '/etc/mysql/debian.cnf'，進而允許本機使用者讀取該檔案並取得敏感資訊，如可執行管理工作的 debian-sys-maint 認證。(CVE-2013-2162)

Matthias Reichl 報告，mysql-5.5 套件缺少先前在 Debian mysql-5.1 中套用的修補程式，因而無法中斷資料庫 'test' 及防止從本機主機匿名存取 (而無需密碼) 'test' 資料庫和任何以 'test_' 開頭的資料庫。此更新已針對 mysql-5.5 套件重新引入這些修補程式。

並未動到既有的資料庫和權限。如需進一步資訊，請參閱此更新隨附的 NEWS 檔案。

遠端 Solaris 系統缺少處理安全性更新的必要修補程式：

- 5.0.67 版之前的 MySQL 允許本機使用者透過呼叫具有已修改 (1) DATA DIRECTORY 或 (2) INDEX DIRECTORY 引數之 MyISAM 資料表的 CREATE TABLE，繞過某些權限檢查，而這些引數原先與沒有符號連結的路徑名稱相關聯，並可以指向未來修改路徑名稱 (使其包含 MySQL 資料主目錄中子目錄的符號連結) 時所建立的資料表。注意：此弱點之所以存在，是因為 CVE-2008-4097 的修正不完整。(CVE-2008-4098)

- 在 MySQL 5.0.x 至 5.0.88 版、5.1.x 至 5.1.41 版和 6.0.9-alpha 之前的 6.0 版中，當資料主目錄中含有其他檔案系統的符號連結，sql/sql_table.cc 會允許經驗證的遠端使用者呼叫含有 (1) DATA DIRECTORY 或 (2) INDEX DIRECTORY 引數 (其會參照需要遵循此符號連結的子目錄) 的 CREATE TABLE，藉此繞過預定的存取限制。(CVE-2008-7247)

- 5.1.46 版之前的 MySQL 允許本機使用者透過符號連結攻擊並搭配 DROP TABLE 命令，刪除其他使用者在 MyISAM 表格中的資料和索引檔案，此弱點與 CVE-2008-4098 和 CVE-2008-7247 不同。(CVE-2010-1626)

- MariaDB 5.5.30 之前的 5.5.x 版、5.3.13 之前的 5.3.x 版、5.2.15 之前的 5.2.x 版和 5.1.68 之前的 5.1.x 版，以及 Oracle MySQL 5.1.69 版和其之前版本、5.5.31 版和其之前版本、5.6.11 版和其之前版本，允許遠端攻擊者透過特製的幾何功能指定大量的點，而系統在處理此功能的二進位表示法時未正確處理這些點，進而造成拒絕服務 (當機)，此問題與數值計算錯誤有關。(CVE-2013-1861)

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.70 in Ubuntu 10.04 LTS. Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.04 have been updated to MySQL 5.5.32.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.
html.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.5.33, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes for further details :

  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     32.html
  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     33.html

In addition this update fixes two issues affecting specifically the mysql-5.5 Debian package :

A race condition in the post-installation script of the mysql-server-5.5 package creates the configuration file '/etc/mysql/debian.cnf' with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as credentials for the debian-sys-maint to perform administration tasks. (CVE-2013-2162 )

Matthias Reichl reported that the mysql-5.5 package misses the patches applied previous in Debian's mysql-5.1 to drop the database 'test' and the permissions that allow anonymous access, without a password, from localhost to the 'test' database and any databases starting with'test_'. This update reintroduces these patches for the mysql-5.5 package.

Existing databases and permissions are not touched. Please refer to the NEWS file provided with this update for further information.

The remote Solaris system is missing necessary patches to address security updates :

  - MySQL before 5.0.67 allows local users to bypass certain     privilege checks by calling CREATE TABLE on a MyISAM     table with modified (1) DATA DIRECTORY or (2) INDEX     DIRECTORY arguments that are originally associated with     pathnames without symlinks, and that can point to tables     created at a future time at which a pathname is modified     to contain a symlink to a subdirectory of the MySQL home     data directory. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2008-4097. (CVE-2008-4098)

  - sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x     through 5.1.41, and 6.0 before 6.0.9-alpha, when the     data home directory contains a symlink to a different     filesystem, allows remote authenticated users to bypass     intended access restrictions by calling CREATE TABLE     with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY     argument referring to a subdirectory that requires     following this symlink. (CVE-2008-7247)

  - MySQL before 5.1.46 allows local users to delete the     data and index files of another user's MyISAM table via     a symlink attack in conjunction with the DROP TABLE     command, a different vulnerability than CVE-2008-4098     and CVE-2008-7247. (CVE-2010-1626)

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x     before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL     5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and     earlier allows remote attackers to cause a denial of     service (crash) via a crafted geometry feature that     specifies a large number of points, which is not     properly handled when processing the binary     representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

This is an update that uses /var/tmp as default tmpdir to prevent potential issues, fixes CVE-2013-1861 and adds some missing command-line options to man-pages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL installed on the remote host is earlier than 5.6.12. Therefore, affected by vulnerabilities in the following components :

 - Audit Log

  - Data Manipulation Language

  - Full Text Search

  - GIS

  - InnoDB

  - MemCached

  - Server Optimizer

  - Server Privileges

  - Server Replication

  - XA Transactions

  - 'Server Options' sub component (for MySQL versions earlier than and up to 5.5.30, as well as 5.6.10)

  - The 'Prepared Statements' sub component (for MySQL versions earlier than and up to 5.5.30, as well as 5.6.10)

ID	Name	Product	Family	Published	Updated	Severity
71474	Debian DSA-2818-1 : mysql-5.5 - 數個弱點	Nessus	Debian Local Security Checks	12/17/2013	1/11/2021	medium
80705	Oracle Solaris 第三方修補程式更新：mysql (multiple_vulnerabilities_in_mysql)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	medium
69073	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : mysql-5.5, mysql-dfsg-5.1 vulnerabilities (USN-1909-1)	Nessus	Ubuntu Local Security Checks	7/26/2013	9/19/2019	medium
71474	Debian DSA-2818-1 : mysql-5.5 - several vulnerabilities	Nessus	Debian Local Security Checks	12/17/2013	1/11/2021	medium
80705	Oracle Solaris Third-Party Patch Update : mysql (multiple_vulnerabilities_in_mysql)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	medium
67261	Fedora 19 : community-mysql-5.5.31-7.fc19 (2013-10020)	Nessus	Fedora Local Security Checks	7/12/2013	1/11/2021	medium
6934	Oracle MySQL 5.6.x < 5.6.12 Multiple Vulnerabilities	Nessus Network Monitor	Database	7/22/2013	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium