The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0364 advisory.

    - Back-port upstream fixes for CVE-2007-5925, CVE-2007-5969, CVE-2007-6303.
    Resolves: #422211

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. (CVE-2007-3781)

A flaw was discovered in MySQL that allowed an authenticated user to gain update privileges for a table in another database, via a view that refers to the external table. (CVE-2007-3782)

MySQL did not require the 'DROP' privilege for 'RENAME TABLE' statements. An authenticated user could use this flaw to rename arbitrary tables. (CVE-2007-2691)

A flaw was discovered in the mysql_change_db function when returning from SQL SECURITY INVOKER stored routines. An authenticated user could use this flaw to gain database privileges. (CVE-2007-2692)

MySQL allowed an authenticated user to bypass logging mechanisms via SQL queries that contain the NULL character, which were not properly handled by the mysql_real_query function. (CVE-2006-0903)

MySQL allowed an authenticated user to access a table through a previously created MERGE table, even after the user's privileges were revoked from the original table, which might violate intended security policy. This is addressed by allowing the MERGE storage engine to be disabled, which can be done by running mysqld with the '--skip-merge' option. (CVE-2006-4031)

MySQL evaluated arguments in the wrong security context, which allowed an authenticated user to gain privileges through a routine that had been made available using 'GRANT EXECUTE'. (CVE-2006-4227)

Multiple flaws in MySQL allowed an authenticated user to cause the MySQL daemon to crash via crafted SQL queries. This only caused a temporary denial of service, as the MySQL daemon is automatically restarted after the crash. (CVE-2006-7232, CVE-2007-1420, CVE-2007-2583)

As well, these updated packages fix the following bugs :

  - a separate counter was used for 'insert delayed'     statements, which caused rows to be discarded. In these     updated packages, 'insert delayed' statements no longer     use a separate counter, which resolves this issue.

  - due to a bug in the Native POSIX Thread Library, in     certain situations, 'flush tables' caused a deadlock on     tables that had a read lock. The mysqld daemon had to be     killed forcefully. Now, 'COND_refresh' has been replaced     with 'COND_global_read_lock', which resolves this issue.

  - mysqld crashed if a query for an unsigned column type     contained a negative value for a 'WHERE [column] NOT IN'     subquery.

  - in master and slave server situations, specifying 'on     duplicate key update' for 'insert' statements did not     update slave servers.

  - in the mysql client, empty strings were displayed as     'NULL'. For example, running 'insert into [table-name]     values (' ');' resulted in a 'NULL' entry being     displayed when querying the table using 'select * from     [table-name];'.

  - a bug in the optimizer code resulted in certain queries     executing much slower than expected.

  - on 64-bit PowerPC architectures, MySQL did not calculate     the thread stack size correctly, which could have caused     MySQL to crash when overly-complex queries were used.

Note: these updated packages upgrade MySQL to version 5.0.45. For a full list of bug fixes and enhancements, refer to the MySQL release notes: http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0.html

The version of MySQL installed on the remote host is reportedly affected by several issues :

  - Evaluation of an 'IN()' predicate with a decimal-valued     argument causes a service crash.

  - A remote, authenticated user can gain privileges.

This update fixes several security vulnerabilities (note: not all versions are affected by every bug) :

  - CVE-2007-2583

  - CVE-2007-2691

  - CVE-2007-2692

  - CVE-2007-5925

  - CVE-2007-5969

  - CVE-2007-6303

  - CVE-2007-6304

The mysql_change_db() function in MySQL 5.0.x before 5.0.40 did not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allowed remote authenticated users to gain privileges (CVE-2007-2692).

The federated engine in MySQL 5.0.x, when performing a certain SHOW TABLE STATUS query, did not properly handle a response with a small number of columns, which could allow a remote MySQL server to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns (CVE-2007-6304).

The updated packages provide MySQL 5.0.45 for all Mandriva Linux platforms that shipped with MySQL 5.0.x which offers a number of feature enhancements and bug fixes. In addition, the updates for Corporate Server 4.0 include support for the Sphinx engine.

Please note that due to the package name change (from 'MySQL' to 'mysql'), the mysqld service will not restart automatically so users must execute 'service mysqld start' after the upgrade is complete.

Updated mysql packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having low security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld), and many different client programs and libraries.

MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. (CVE-2007-3781)

A flaw was discovered in MySQL that allowed an authenticated user to gain update privileges for a table in another database, via a view that refers to the external table. (CVE-2007-3782)

MySQL did not require the 'DROP' privilege for 'RENAME TABLE' statements. An authenticated user could use this flaw to rename arbitrary tables. (CVE-2007-2691)

A flaw was discovered in the mysql_change_db function when returning from SQL SECURITY INVOKER stored routines. An authenticated user could use this flaw to gain database privileges. (CVE-2007-2692)

MySQL allowed an authenticated user to bypass logging mechanisms via SQL queries that contain the NULL character, which were not properly handled by the mysql_real_query function. (CVE-2006-0903)

MySQL allowed an authenticated user to access a table through a previously created MERGE table, even after the user's privileges were revoked from the original table, which might violate intended security policy. This is addressed by allowing the MERGE storage engine to be disabled, which can be done by running mysqld with the '--skip-merge' option. (CVE-2006-4031)

MySQL evaluated arguments in the wrong security context, which allowed an authenticated user to gain privileges through a routine that had been made available using 'GRANT EXECUTE'. (CVE-2006-4227)

Multiple flaws in MySQL allowed an authenticated user to cause the MySQL daemon to crash via crafted SQL queries. This only caused a temporary denial of service, as the MySQL daemon is automatically restarted after the crash. (CVE-2006-7232, CVE-2007-1420, CVE-2007-2583)

As well, these updated packages fix the following bugs :

* a separate counter was used for 'insert delayed' statements, which caused rows to be discarded. In these updated packages, 'insert delayed' statements no longer use a separate counter, which resolves this issue.

* due to a bug in the Native POSIX Thread Library, in certain situations, 'flush tables' caused a deadlock on tables that had a read lock. The mysqld daemon had to be killed forcefully. Now, 'COND_refresh' has been replaced with 'COND_global_read_lock', which resolves this issue.

* mysqld crashed if a query for an unsigned column type contained a negative value for a 'WHERE [column] NOT IN' subquery.

* in master and slave server situations, specifying 'on duplicate key update' for 'insert' statements did not update slave servers.

* in the mysql client, empty strings were displayed as 'NULL'. For example, running 'insert into [table-name] values (' ');' resulted in a 'NULL' entry being displayed when querying the table using 'select * from [table-name];'.

* a bug in the optimizer code resulted in certain queries executing much slower than expected.

* on 64-bit PowerPC architectures, MySQL did not calculate the thread stack size correctly, which could have caused MySQL to crash when overly-complex queries were used.

Note: these updated packages upgrade MySQL to version 5.0.45. For a full list of bug fixes and enhancements, refer to the MySQL release notes: http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0.html

All mysql users are advised to upgrade to these updated packages, which resolve these issues.

USN-588-1 fixed vulnerabilities in MySQL. In fixing CVE-2007-2692 for Ubuntu 6.06, additional improvements were made to make privilege checks more restictive. As a result, an upstream bug was exposed which could cause operations on tables or views in a different database to fail. This update fixes the problem.

We apologize for the inconvenience.

Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232)

Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges. This issue does not affect Ubuntu 7.10. (CVE-2007-2692)

Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303)

Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232)

Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges.
This issue does not affect Ubuntu 7.10. (CVE-2007-2692)

Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303)

Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes several security vulnerabilities (note: not all versions are affected by every bug) :

  - CVE-2007-2583 

  - CVE-2007-2691 

  - CVE-2007-2692 

  - CVE-2007-5925 

  - CVE-2007-5969 

  - CVE-2007-6303 

  - CVE-2007-6304

Several vulnerabilities have been found in the MySQL database packages with implications ranging from unauthorized database modifications to remotely triggered server crashes. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2583     The in_decimal::set function in item_cmpfunc.cc in MySQL     before 5.0.40 allows context-dependent attackers to     cause a denial of service (crash) via a crafted IF     clause that results in a divide-by-zero error and a NULL     pointer dereference. (Affects source version 5.0.32.)

  - CVE-2007-2691     MySQL does not require the DROP privilege for RENAME     TABLE statements, which allows remote authenticated     users to rename arbitrary tables. (All supported     versions affected.)

  - CVE-2007-2692     The mysql_change_db function does not restore     THD::db_access privileges when returning from SQL     SECURITY INVOKER stored routines, which allows remote     authenticated users to gain privileges. (Affects source     version 5.0.32.)

  - CVE-2007-3780     MySQL could be made to overflow a signed char during     authentication. Remote attackers could use specially     crafted authentication requests to cause a denial of     service. (Upstream source versions 4.1.11a and 5.0.32     affected.)

  - CVE-2007-3782     Phil Anderton discovered that MySQL did not properly     verify access privileges when accessing external tables.
    As a result, authenticated users could exploit this to     obtain UPDATE privileges to external tables. (Affects     source version 5.0.32.)

  - CVE-2007-5925     The convert_search_mode_to_innobase function in     ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and     earlier allows remote authenticated users to cause a     denial of service (database crash) via a certain     CONTAINS operation on an indexed column, which triggers     an assertion error. (Affects source version 5.0.32.)

A vulnerability was found in MySQL's authentication protocol, making it possible for a remote unauthenticated attacker to send a specially crafted authentication request to the MySQL server causing it to crash (CVE-2007-3780).

Another flaw was discovered in MySQL that allowed remote authenticated users to gain update privileges for a table in another database via a view that refers to the external table (CVE-2007-3782).

Updated packages have been patched to prevent these issues.

The version of MySQL installed on the remote host reportedly is affected by three issues :

- A user can rename a table without having DROP privileges.

-If a stored routine is declared as 'SQL SECURITY INVOKER', a user may be able to gain privileges by invoking that routine.

-A user with only ALTER privileges on a partitioned table can discover information about the table that should require SELECT privileges.

The version of MySQL installed on the remote host reportedly is affected by several issues :

  - Evaluation of an 'IN()' predicate with a decimal-valued     argument causes a service crash.

  - A user can rename a table even though he does not have     DROP privileges.

  - If a stored routine is declared as 'SQL SECURITY INVOKER',     a user may be able to gain privileges by invoking that     routine.

  - A user with only ALTER privileges on a partitioned table     can discover information about the table that should     require SELECT privileges.

The version of MySQL installed on the remote host reportedly is affected by a denial of service vulnerability that may be triggered with a specially crafted IF query.  An attacker who can execute arbitrary SELECT statements may be able to leverage this issue to crash the affected service.

ID	Name	Product	Family	Severity
180609	Oracle Linux 5 : mysql (ELSA-2008-0364)	Nessus	Oracle Linux Local Security Checks	medium
60406	Scientific Linux Security Update : mysql on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
17832	MySQL 5.0 < 5.0.40 Multiple Vulnerabilities	Nessus	Databases	medium
41184	SuSE9 Security Update : MySQL (YOU Patch Number 12044)	Nessus	SuSE Local Security Checks	high
36399	Mandriva Linux Security Advisory : mysql (MDVSA-2008:028)	Nessus	Mandriva Local Security Checks	medium
32425	RHEL 5 : mysql (RHSA-2008:0364)	Nessus	Red Hat Local Security Checks	medium
31783	Ubuntu 6.06 LTS : mysql-dfsg-5.0 regression (USN-588-2)	Nessus	Ubuntu Local Security Checks	high
31638	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mysql-dfsg-5.0 vulnerabilities (USN-588-1)	Nessus	Ubuntu Local Security Checks	high
30182	SuSE 10 Security Update : MySQL (ZYPP Patch Number 4879)	Nessus	SuSE Local Security Checks	high
30180	openSUSE 10 Security Update : libmysqlclient-devel (libmysqlclient-devel-4873)	Nessus	SuSE Local Security Checks	high
28336	Debian DSA-1413-1 : mysql - multiple vulnerabilities	Nessus	Debian Local Security Checks	medium
26009	Mandrake Linux Security Advisory : MySQL (MDKSA-2007:177)	Nessus	Mandriva Local Security Checks	medium
3993	Oracle MySQL < 5.1.18 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
25242	MySQL 5.1 < 5.1.18 Multiple Vulnerabilities	Nessus	Databases	medium
25198	MySQL Crafted IF Clause Divide-by-zero NULL Dereference DoS	Nessus	Databases	medium
801164	MySQL < 5.1.18 Multiple Vulnerabilities	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2007-2692

high

Tenable Plugins

medium

medium

medium

high

medium

medium

high

high

high

high

medium

medium

medium

medium

medium

medium