MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated by using strcat, on_exit, and exit.

SunOS 5.10_x86 : mysql patch.
Date this patch was last updated by Sun : Jun/27/08

SunOS 5.10 : mysql patch.
Date this patch was last updated by Sun : Jun/27/08

Updated mysql-server packages that fix several vulnerabilities are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server.

This update fixes several security risks in the MySQL server.

Stefano Di Paola discovered two bugs in the way MySQL handles user-defined functions. A user with the ability to create and execute a user defined function could potentially execute arbitrary code on the MySQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0709 and CVE-2005-0710 to these issues.

Stefano Di Paola also discovered a bug in the way MySQL creates temporary tables. A local user could create a specially crafted symlink which could result in the MySQL server overwriting a file which it has write access to. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-0711 to this issue.

All users of the MySQL server are advised to upgrade to these updated packages, which contain fixes for these issues.

Stefano Di Paola discovered three privilege escalation flaws in the MySQL server :

  - If an authenticated user had INSERT privileges on the     'mysql' administrative database, the CREATE FUNCTION     command allowed that user to use libc functions to     execute arbitrary code with the privileges of the     database server (user 'mysql'). (CAN-2005-0709)

  - If an authenticated user had INSERT privileges on the     'mysql' administrative database, it was possible to load     a library located in an arbitrary directory by using     INSERT INTO mysql.func instead of CREATE FUNCTION. This     allowed the user to execute arbitrary code with the     privileges of the database server (user 'mysql').
    (CAN-2005-0710)

  - Temporary files belonging to tables created with CREATE     TEMPORARY TABLE were handled in an insecure way. This     allowed any local computer user to overwrite arbitrary     files with the privileges of the database server.
    (CAN-2005-0711)

Matt Brubeck discovered that the directory /usr/share/mysql/ was owned and writable by the database server user 'mysql'. This directory contains scripts which are usually run by root. This allowed a local attacker who already has mysql privileges to gain full root access by modifying a script and tricking root into executing it.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2005-007 applied.

This security update contains fixes for the following products :

  - Apache 2
  - AppKit
  - Bluetooth
  - CoreFoundation
  - CUPS
  - Directory Services
  - HItoolbox
  - Kerberos
  - loginwindow
  - Mail
  - MySQL
  - OpenSSL
  - QuartzComposerScreenSaver
  - ping
  - Safari
  - SecurityInterface
  - servermgrd
  - servermgr_ipfilter
  - SquirelMail
  - traceroute
  - WebKit
  - WebLog Server
  - X11
  - zlib

SecurityFocus reports :

MySQL is reported prone to an insecure temporary file creation vulnerability.

Reports indicate that an attacker that has 'CREATE TEMPORARY TABLE' privileges on an affected installation may leverage this vulnerability to corrupt files with the privileges of the MySQL process.

MySQL is reported prone to an input validation vulnerability that can be exploited by remote users that have INSERT and DELETE privileges on the 'mysql' administrative database.

Reports indicate that this issue may be leveraged to load an execute a malicious library in the context of the MySQL process.

Finally, MySQL is reported prone to a remote arbitrary code execution vulnerability. It is reported that the vulnerability may be triggered by employing the 'CREATE FUNCTION' statement to manipulate functions in order to control sensitive data structures.

This issue may be exploited to execute arbitrary code in the context of the database process.

Several vulnerabilities have been discovered in MySQL, a popular database. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2004-0957     Sergei Golubchik discovered a problem in the access     handling for similar named databases. If a user is     granted privileges to a database with a name containing     an underscore ('_'), the user also gains privileges to     other databases with similar names.

  - CAN-2005-0709

    Stefano Di Paola discovered that MySQL allows remote     authenticated users with INSERT and DELETE privileges to     execute arbitrary code by using CREATE FUNCTION to     access libc calls.

  - CAN-2005-0710

    Stefano Di Paola discovered that MySQL allows remote     authenticated users with INSERT and DELETE privileges to     bypass library path restrictions and execute arbitrary     libraries by using INSERT INTO to modify the mysql.func     table.

  - CAN-2005-0711

    Stefano Di Paola discovered that MySQL uses predictable     file names when creating temporary tables, which allows     local users with CREATE TEMPORARY TABLE privileges to     overwrite arbitrary files via a symlink attack.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:334 advisory.

    MySQL is a multi-user, multi-threaded SQL database server.

    This update fixes several security risks in the MySQL server.

    Stefano Di Paola discovered two bugs in the way MySQL handles user-defined     functions. A user with the ability to create and execute a user defined     function could potentially execute arbitrary code on the MySQL server. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the names CAN-2005-0709 and CAN-2005-0710 to these issues.

    Stefano Di Paola also discovered a bug in the way MySQL creates temporary     tables. A local user could create a specially crafted symlink which could     result in the MySQL server overwriting a file which it has write access to.
    The Common Vulnerabilities and Exposures project has assigned the name     CAN-2005-0711 to this issue.

    All users of the MySQL server are advised to upgrade to these updated     packages, which contain fixes for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is missing the patch for the advisory SUSE-SA:2005:019 (mysql).


MySQL is an Open Source database server, commonly used together with web services provided by PHP scripts or similar.

This security update fixes a broken mysqlhotcopy script as well as several security related bugs:

- CVE-2005-0709: MySQL allowed remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated by using strcat, on_exit, and exit.

- CVE-2005-0710: MySQL allowed remote authenticated users with INSERT and DELETE privileges to bypass library path restrictions and execute arbitrary libraries by using INSERT INTO to modify the mysql.func table, which is processed by the udf_init function.

- CVE-2005-0711: MySQL used predictable file names when creating temporary tables, which allows local users with CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via a symlink attack.


The first two vulnerabilities can be exploited by an attacker using SQL inject attack vectors into a flawed PHP application for instance.

A number of vulnerabilities were discovered by Stefano Di Paola in the MySQL server :

If an authenticated user had INSERT privileges on the 'mysql' database, the CREATE FUNCTION command allowed that user to use libc functions to execute arbitrary code with the privileges of the user running the database server (mysql) (CVE-2005-0709).

If an authenticated user had INSERT privileges on the 'mysql' database, it was possible to load a library located in an arbitrary directory by using INSERT INTO mysql.func instead of CREATE FUNCTION.
This also would allow the user to execute arbitrary code with the privileges of the user running the database server (CVE-2005-0710).

Finally, temporary files belonging to tables created with CREATE TEMPORARY TABLE were handled in an insecure manner, allowing any local user to overwrite arbitrary files with the privileges of the database server (CVE-2005-0711).

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200503-19 (MySQL: Multiple vulnerabilities)

    MySQL fails to properly validate input for authenticated users with     INSERT and DELETE privileges (CAN-2005-0709 and CAN-2005-0710).
    Furthermore MySQL uses predictable filenames when creating temporary     files with CREATE TEMPORARY TABLE (CAN-2005-0711).
  Impact :

    An attacker with INSERT and DELETE privileges could exploit this to     manipulate the mysql table or accessing libc calls, potentially leading     to the execution of arbitrary code with the permissions of the user     running MySQL. An attacker with CREATE TEMPORARY TABLE privileges could     exploit this to overwrite arbitrary files via a symlink attack.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of MySQL that is older than version 4.0.24.  This version of MySQL is vulnerable to multiple remote attacks.  Specifically
1) The MySQL is vulnerable to a flaw where the database temporary files are world-writeable and use a common name syntax.  An attacker may be able to guess a file name and inject data into the temp file.
2) Authenticated users that have 'CREATE TEMPORARY TABLE' privileges will be able to corrupt MySQL files with the privileges of the MySQL process
3)  Authenticated users with the 'INSERT' and 'DELETE' privileges may be able to escalate their database rights due to an input validation error in MySQL
4) Authenticated users that have 'INSERT' and 'DELETE' privileges may also abuse the 'CREATE FUNCTION' statement in order to gain access to restricted data structures. 

The remote host is running a version of MySQL which older than version 4.0.24 or 4.1.10a.  Such versions are potentially affected by multiple issues.
 
  - MySQL uses predictable file names when creating     temporary tables, which allows local users with 'CREATE     TEMPORARY TABLE' privileges to overwrite arbitrary files     via a symlink attack. (CVE-2005-0711)

  - A flaw exists that may allow a malicious user to gain     access to unauthorized privileges when an authenticated     user with 'INSERT' and 'DELETE' privileges bypasses     library path restrictions using 'INSERT INTO' to modify     the 'mysql.func' table. (CVE-2005-0709)

  - A flaw exists that may allow a mlicious user to load     arbitrary libraries when an authenticated user with     'INSERT' and 'DELETE' privileges use the 'CREATE     FUNCTION' command to specify and load an arbitrary     custom library. (CVE-2005-0710)

The remote host is running a version of MySQL that is older than version 4.0.24.  This version of MySQL is vulnerable to multiple remote attacks.  Specifically
1) The MySQL is vulnerable to a flaw where the database temporary files are world-writeable and use a common name syntax.  An attacker may be able to guess a file name and inject data into the temp file.
2) Authenticated users that have 'CREATE TEMPORARY TABLE' privileges will be able to corrupt MySQL files with the privileges of the MySQL process
3)  Authenticated users with the 'INSERT' and 'DELETE' privileges may be able to escalate their database rights due to an input validation error in MySQL
4) Authenticated users that have 'INSERT' and 'DELETE' privileges may also abuse the 'CREATE FUNCTION' statement in order to gain access to restricted data structures.

ID	Name	Product	Family	Severity
107863	Solaris 10 (x86) : 120293-02	Nessus	Solaris Local Security Checks	high
107361	Solaris 10 (sparc) : 120292-02	Nessus	Solaris Local Security Checks	high
21926	CentOS 3 : mysql-server (CESA-2005:348)	Nessus	CentOS Local Security Checks	medium
20722	Ubuntu 4.10 : mysql-dfsg vulnerabilities (USN-96-1)	Nessus	Ubuntu Local Security Checks	medium
19463	Mac OS X Multiple Vulnerabilities (Security Update 2005-007)	Nessus	MacOS X Local Security Checks	critical
18956	FreeBSD : mysql-server -- multiple remote vulnerabilities (619ef337-949a-11d9-b813-00d05964249f)	Nessus	FreeBSD Local Security Checks	medium
18042	Debian DSA-707-1 : mysql - several vulnerabilities	Nessus	Debian Local Security Checks	medium
17981	RHEL 3 : mysql-server (RHSA-2005:348)	Nessus	Red Hat Local Security Checks	medium
17646	RHEL 4 : mysql (RHSA-2005:334)	Nessus	Red Hat Local Security Checks	high
17618	SUSE-SA:2005:019: mysql	Nessus	SuSE Local Security Checks	medium
17601	Mandrake Linux Security Advisory : MySQL (MDKSA-2005:060)	Nessus	Mandriva Local Security Checks	high
17344	GLSA-200503-19 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
2696	Oracle MySQL Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
17313	MySQL < 4.0.24 / 4.1.10a Multiple Vulnerabilities	Nessus	Databases	medium
801130	MySQL Multiple Vulnerabilities	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2005-0709

high

Tenable Plugins

high

high

medium

medium

critical

medium

medium

medium

high

medium

high

medium

medium

medium

medium