MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows attackers to cause a denial of service (crash or hang) via multiple threads that simultaneously alter MERGE table UNIONs.

SunOS 5.10_x86 : mysql patch.
Date this patch was last updated by Sun : Jun/27/08

SunOS 5.10 : mysql patch.
Date this patch was last updated by Sun : Jun/27/08

Several vulnerabilities have been discovered in the MySQL database server.

Lukasz Wojtow discovered a potential buffer overflow in the function mysql_real_connect(). A malicious name server could send specially crafted DNS packages which might result in execution of arbitrary code with the database server's privileges. However, it is believed that this bug cannot be exploited with the C Standard library (glibc) that Ubuntu uses. (CAN-2004-0836).

Dean Ellis noticed a flaw that allows an authorized MySQL user to cause a denial of service (crash or hang) via concurrent execution of certain statements (ALTER TABLE ... UNION=, FLUSH TABLES) on tables of type MERGE (CAN-2004-0837)

Some query strings containing a double quote (like MATCH ... AGAINST (' some ' query' IN BOOLEAN MODE) ) that did not have a matching closing double quote caused a denial of service (server crash). Again, this is only exploitable by authorized mysql users. (CAN-2004-0956)

If a user was granted privileges to a database with a name containing an underscore ('_'), the user also gained the ability to grant privileges to other databases with similar names. (CAN-2004-0957).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dean Ellis reported a denial of service vulnerability in the MySQL server :

Multiple threads ALTERing the same (or different) MERGE tables to change the UNION eventually crash the server or hang the individual threads.

Note that a script demonstrating the problem is included in the MySQL bug report. Attackers that have control of a MySQL account can easily use a modified version of that script during an attack.

Several problems have been discovered in MySQL, a commonly used SQL database on Unix servers. The following problems have been identified by the Common Vulnerabilities and Exposures Project :

  - CAN-2004-0835     Oleksandr Byelkin noticed that ALTER TABLE ... RENAME     checks CREATE/INSERT rights of the old table instead of     the new one.

  - CAN-2004-0836

    Lukasz Wojtow noticed a buffer overrun in the     mysql_real_connect function.

  - CAN-2004-0837

    Dean Ellis noticed that multiple threads ALTERing the     same (or different) MERGE tables to change the UNION can     cause the server to crash or stall.

An updated mysql-server package that fixes various security issues is now available in the Red Hat Enterprise Linux 3 Extras channel of Red Hat Network.

MySQL is a multi-user, multi-threaded SQL database server.

A number of security issues that affect the mysql-server package have been reported. Although Red Hat Enterprise Linux 3 does not ship with the mysql-server package, the affected package is available from the Red Hat Network Extras channel.

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Users of mysql-server should upgrade to these erratum packages, which correct these issues.

A number of problems have been discovered in the MySQL database server :

Jeroen van Wolffelaar discovered an insecure temporary file vulnerability in the mysqlhotcopy script when using the scp method (CVE-2004-0457).

Oleksandr Byelkin discovered that the 'ALTER TABLE ... RENAME' would check the CREATE/INSERT rights of the old table rather than the new one (CVE-2004-0835).

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION can cause the server to crash or stall (CVE-2004-0837).

The updated MySQL packages have been patched to protect against these issues.

The remote host is affected by the vulnerability described in GLSA-200410-22 (MySQL: Multiple vulnerabilities)

    The following vulnerabilities were found and fixed in MySQL:
    Oleksandr Byelkin found that ALTER TABLE ... RENAME checks CREATE/INSERT     rights of the old table instead of the new one (CAN-2004-0835). Another     privilege checking bug allowed users to grant rights on a database they had     no rights on.
    Dean Ellis found a defect where multiple threads ALTERing the MERGE tables     to change the UNION could cause the server to crash (CAN-2004-0837).
    Another crash was found in MATCH ... AGAINST() queries with missing closing     double quote.
    Finally, a buffer overrun in the mysql_real_connect function was found by     Lukasz Wojtow (CAN-2004-0836).
  Impact :

    The privilege checking issues could be used by remote users to bypass their     rights on databases. The two crashes issues could be exploited by a remote     user to perform a Denial of Service attack on MySQL server. The buffer     overrun issue could also be exploited as a Denial of Service attack, and     may allow to execute arbitrary code with the rights of the MySQL daemon     (typically, the 'mysql' user).
  Workaround :

    There is no known workaround at this time.

Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1.

MySQL is a multi-user, multi-threaded SQL database server.

A number security issues that affect the mysql server have been reported :

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Additionally, the following minor temporary file vulnerabilities were discovered :

  - Stan Bubroski and Shaun Colley found a temporary file     vulnerability in the mysqlbug script (CVE-2004-0381). -     A temporary file vulnerability was discovered in     mysqld_multi (CVE-2004-0388). - Jeroen van Wolffelaar     discovered an temporary file vulnerability in the     mysqlhotcopy script when using the scp method     (CVE-2004-0457).

All users of mysql should upgrade to these updated packages, which resolve these issues and also include fixes for a number of small bugs.

The remote host is running a version of the MySQL database that is older than 4.0.21.

MySQL is a database that runs on both Linux/BSD and Windows platforms.
The remote version of this software is vulnerable to specially crafted ALTER TABLE SQL query that can be exploited to bypass some applied security restrictions or cause a denial of service.

To exploit this flaw, an attacker would need the ability to execute arbitrary SQL statements on the remote host. 

The remote host is running a version of the MySQL database that is older than 3.23.59.

MySQL is a database that runs on both Linux/BSD and Windows platforms.
The remote version of this software is vulnerable to specially crafted ALTER TABLE SQL query that can be exploited to bypass some applied security restrictions or cause a denial of service.

To exploit this flaw, an attacker would need the ability to execute arbitrary SQL statements on the remote host. 

The remote host is running a version of the MySQL database which is older than 4.0.21 or 3.23.59.

MySQL is a database which runs on both Linux/BSD and Windows platform.
The remote version of this software is vulnerable to specially crafted 'ALTER TABLE SQL' query which can be exploited to bypass some applied security restrictions or cause a denial of service.

To exploit this flaw, an attacker would need the ability to execute arbitrary SQL statements on the remote host.

The remote host is running a version of MySQL that is older than version 3.23.49 or than 4.0.20.  The version of the utility Mysqlhotcopy included in these versions of MySQL is reported to be prone to a vulnerability that may permit an attacker to overwrite arbitrary files on the database server with the privilege of the targeted user. Privilege escalation may also be possible. An attacker requires local interactive access in order to exploit this vulnerability. 

The remote host is running a version of the MySQL database that is older than 3.23.59.

MySQL is a database that runs on both Linux/BSD and Windows platforms.
The remote version of this software is vulnerable to specially crafted ALTER TABLE SQL query that can be exploited to bypass some applied security restrictions or cause a denial of service.

To exploit this flaw, an attacker would need the ability to execute arbitrary SQL statements on the remote host.

The remote host is running a version of the MySQL database that is older than 4.0.21.

MySQL is a database that runs on both Linux/BSD and Windows platforms.
The remote version of this software is vulnerable to specially crafted ALTER TABLE SQL query that can be exploited to bypass some applied security restrictions or cause a denial of service.

To exploit this flaw, an attacker would need the ability to execute arbitrary SQL statements on the remote host.

ID	Name	Product	Family	Severity
107863	Solaris 10 (x86) : 120293-02	Nessus	Solaris Local Security Checks	high
107361	Solaris 10 (sparc) : 120292-02	Nessus	Solaris Local Security Checks	high
20648	Ubuntu 4.10 : mysql-dfsg vulnerabilities (USN-32-1)	Nessus	Ubuntu Local Security Checks	critical
18830	FreeBSD : mysql -- ALTER MERGE denial of service vulnerability (06a6b2cf-484b-11d9-813c-00065be4b5b6)	Nessus	FreeBSD Local Security Checks	low
15660	Debian DSA-562-1 : mysql - several vulnerabilities	Nessus	Debian Local Security Checks	critical
15631	RHEL 3 : mysql-server (RHSA-2004:611)	Nessus	Red Hat Local Security Checks	critical
15599	Mandrake Linux Security Advisory : MySQL (MDKSA-2004:119)	Nessus	Mandriva Local Security Checks	critical
15558	GLSA-200410-22 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
15536	RHEL 2.1 : mysql (RHSA-2004:597)	Nessus	Red Hat Local Security Checks	critical
2362	Oracle MySQL < 4.0.21 Multiple Vulnerabilities (2)	Nessus Network Monitor	Database	high
2361	Oracle MySQL < 3.23.59 Multiple Vulnerabilities (2)	Nessus Network Monitor	Database	high
15449	MySQL < 3.23.59 / 4.0.21 Multiple Vulnerabilities	Nessus	Databases	high
2129	Oracle MySQL Mysqlhotcopy Script Insecure Temporary File Creation	Nessus Network Monitor	Database	high
801162	MySQL Mysqlhotcopy Script Insecure Temporary File Creation	Log Correlation Engine	Database	medium
801151	MySQL < 3.23.59 Multiple Vulnerabilities (2)	Log Correlation Engine	Database	high
801124	MySQL < 4.0.21 Multiple Vulnerabilities (2)	Log Correlation Engine	Database	high

Detections

Analytics

CVE-2004-0837

high

Tenable Plugins

high

high

critical

low

critical

critical

critical

critical

critical

high

high

high

high

medium

high

high