Rapid7 Vulnerability & Exploit Database

RHSA-2002:288: Updated MySQL packages fix various security issues

Back to Search

RHSA-2002:288: Updated MySQL packages fix various security issues

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
12/23/2002
Created
07/25/2018
Added
10/28/2005
Modified
07/04/2017

Description

Updated MySQL packages are available for Red Hat Linux 7, 7.1, 7.2, 7.3, and 8.0 which fix security vulnerabilities found in the MySQL server.

MySQL is a multi-user, multi-threaded SQL database server. While auditing MySQL, Stefan Esser found security vulnerabilities that can be used to crash the server or allow MySQL users to gain privileges. A signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.x to 3.23.53a allows remote attackers to cause a denial of service (crash or hang) in mysqld by causing large negative integers to be provided to a memcpy call. (CAN-2002-1373) The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a and 4.x to 4.0.5a allows a remote attacker to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password. (CAN-2002-1374) The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a and 4.x to 4.0.5a allows remote attackers to execute arbitrary code via a long response. (CAN-2002-1375) The MySQL client library (libmysqlclient) in MySQL 3.x to 3.23.53a and 4.x to 4.0.5a does not properly verify length fields for certain responses in the read_rows or read_one_row routines, which allows a malicious server to cause a denial of service and possibly execute arbitrary code. (CAN-2002-1376) Red Hat Linux 7, 7.1, 7.2, 7.3, and 8.0 contain versions of MySQL that are vulnerable to these issues. All users of MySQL are advised to upgrade to the erratum packages containing MySQL 3.23.54a which is not vulnerable to these issues.

Solution(s)

  • redhat-upgrade-mysql
  • redhat-upgrade-mysql-devel
  • redhat-upgrade-mysql-server
  • redhat-upgrade-mysqlclient9

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;