Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user has privileges for a database whose name includes a "_" (underscore), grants privileges to other databases that have similar names, which can allow the user to conduct unauthorized activities.

Several vulnerabilities have been discovered in the MySQL database server.

Lukasz Wojtow discovered a potential buffer overflow in the function mysql_real_connect(). A malicious name server could send specially crafted DNS packages which might result in execution of arbitrary code with the database server's privileges. However, it is believed that this bug cannot be exploited with the C Standard library (glibc) that Ubuntu uses. (CAN-2004-0836).

Dean Ellis noticed a flaw that allows an authorized MySQL user to cause a denial of service (crash or hang) via concurrent execution of certain statements (ALTER TABLE ... UNION=, FLUSH TABLES) on tables of type MERGE (CAN-2004-0837)

Some query strings containing a double quote (like MATCH ... AGAINST (' some ' query' IN BOOLEAN MODE) ) that did not have a matching closing double quote caused a denial of service (server crash). Again, this is only exploitable by authorized mysql users. (CAN-2004-0956)

If a user was granted privileges to a database with a name containing an underscore ('_'), the user also gained the ability to grant privileges to other databases with similar names. (CAN-2004-0957).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-32-1 fixed a database privilege escalation vulnerability; original advisory text :

'If a user was granted privileges to a database with a name containing an underscore ('_'), the user also gained the ability to grant privileges to other databases with similar names. (CAN-2004-0957)'

Recently a corner case was discovered where this vulnerability can still be exploited, so another update is necessary.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

When a user is granted access to a database with a name containing an underscore and the underscore is not escaped then that user might also be able to access other, similarly named, databases on the affected system.

The problem is that the underscore is seen as a wildcard by MySQL and therefore it is possible that an admin might accidentally GRANT a user access to multiple databases.

Several vulnerabilities have been discovered in MySQL, a popular database. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2004-0957     Sergei Golubchik discovered a problem in the access     handling for similar named databases. If a user is     granted privileges to a database with a name containing     an underscore ('_'), the user also gains privileges to     other databases with similar names.

  - CAN-2005-0709

    Stefano Di Paola discovered that MySQL allows remote     authenticated users with INSERT and DELETE privileges to     execute arbitrary code by using CREATE FUNCTION to     access libc calls.

  - CAN-2005-0710

    Stefano Di Paola discovered that MySQL allows remote     authenticated users with INSERT and DELETE privileges to     bypass library path restrictions and execute arbitrary     libraries by using INSERT INTO to modify the mysql.func     table.

  - CAN-2005-0711

    Stefano Di Paola discovered that MySQL uses predictable     file names when creating temporary tables, which allows     local users with CREATE TEMPORARY TABLE privileges to     overwrite arbitrary files via a symlink attack.

A vulnerability in MySQL would allow a user with grant privileges to a database with a name containing an underscore character ('_') to have the ability to grant privileges to other databases with similar names.
This problem was previously discovered and fixed, but a new case where the problem still existed was recently discovered.

The updated packages have been patched to correct this issue.

An updated mysql-server package that fixes various security issues is now available in the Red Hat Enterprise Linux 3 Extras channel of Red Hat Network.

MySQL is a multi-user, multi-threaded SQL database server.

A number of security issues that affect the mysql-server package have been reported. Although Red Hat Enterprise Linux 3 does not ship with the mysql-server package, the affected package is available from the Red Hat Network Extras channel.

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Users of mysql-server should upgrade to these erratum packages, which correct these issues.

The remote host is running a version of MySQL that is older than version 4.0.21.
It is vulnerable to a flaw that may allow an attacker to gain access to unauthorized databases. An attacker can exploit this vulnerability if he has GRANT privileges on databases containing '_'. 

Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1.

MySQL is a multi-user, multi-threaded SQL database server.

A number security issues that affect the mysql server have been reported :

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Additionally, the following minor temporary file vulnerabilities were discovered :

  - Stan Bubroski and Shaun Colley found a temporary file     vulnerability in the mysqlbug script (CVE-2004-0381). -     A temporary file vulnerability was discovered in     mysqld_multi (CVE-2004-0388). - Jeroen van Wolffelaar     discovered an temporary file vulnerability in the     mysqlhotcopy script when using the scp method     (CVE-2004-0457).

All users of mysql should upgrade to these updated packages, which resolve these issues and also include fixes for a number of small bugs.

You are running a version of MySQL which is older than version 4.0.21.
Such versions are potentially affected by two flaws :

  - There is an unauthorized database GRANT privilege     vulnerability, which may allow an attacker to misuse the     GRANT privilege it has been given and to use it against     other databases. (CVE-2004-0957)

  - A denial of service vulnerability may be triggered by     the misuse of the FULLTEXT search functionality.
    (CVE-2004-0956)

The remote host is running a version of MySQL that is older than version 3.23.49 or than 4.0.20.  The version of the utility Mysqlhotcopy included in these versions of MySQL is reported to be prone to a vulnerability that may permit an attacker to overwrite arbitrary files on the database server with the privilege of the targeted user. Privilege escalation may also be possible. An attacker requires local interactive access in order to exploit this vulnerability. 

The remote host is running a version of MySQL that is older than version 4.0.21.
It is vulnerable to a flaw that may allow an attacker to gain access to unauthorized databases. An attacker can exploit this vulnerability if he has GRANT privileges on databases containing '_'.

ID	Name	Product	Family	Severity
20648	Ubuntu 4.10 : mysql-dfsg vulnerabilities (USN-32-1)	Nessus	Ubuntu Local Security Checks	critical
20495	Ubuntu 4.10 : mysql-dfsg vulnerability (USN-109-1)	Nessus	Ubuntu Local Security Checks	medium
18817	FreeBSD : mysql -- GRANT access restriction problem (01c231cd-4393-11d9-8bb9-00065be4b5b6)	Nessus	FreeBSD Local Security Checks	medium
18042	Debian DSA-707-1 : mysql - several vulnerabilities	Nessus	Debian Local Security Checks	medium
18032	Mandrake Linux Security Advisory : MySQL (MDKSA-2005:070)	Nessus	Mandriva Local Security Checks	medium
15631	RHEL 3 : mysql-server (RHSA-2004:611)	Nessus	Red Hat Local Security Checks	critical
2370	Oracle MySQL < 4.0.21 Remote GRANT Privilege Escalation	Nessus Network Monitor	Database	medium
15536	RHEL 2.1 : mysql (RHSA-2004:597)	Nessus	Red Hat Local Security Checks	critical
15477	MySQL < 4.0.21 Multiple Vulnerabilities	Nessus	Databases	medium
2129	Oracle MySQL Mysqlhotcopy Script Insecure Temporary File Creation	Nessus Network Monitor	Database	high
801162	MySQL Mysqlhotcopy Script Insecure Temporary File Creation	Log Correlation Engine	Database	medium
801119	MySQL < 4.0.21 Remote GRANT Privilege Escalation	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2004-0957

high

Tenable Plugins

critical

medium

medium

medium

medium

critical

medium

critical

medium

high

medium

medium