MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service (daemon crash) via a malformed password packet in the connection protocol.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2007-0875 advisory.

    [4.1.20-2.RHEL4.1.0.1]
     - Fix CVE-2007-3780: remote DOS via bad password length byte      Resolves: #257621
     - Workaround for new gcc bug on ia64: it locks up while compiling      sql_table.cc

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was discovered in MySQL's authentication protocol. It is possible for a remote unauthenticated attacker to send a specially crafted authentication request to the MySQL server causing it to crash. (CVE-2007-3780)

MySQL reports :

A malformed password packet in the connection protocol could cause the server to crash.

This update provides fixes for :

  - remote triggerable crash. (CVE-2007-3780)

  - query tables without propper authorisation.
    (CVE-2007-3781)

  - gain update privileges without propper authorisation.
    (CVE-2007-3782)

Neil Kettle discovered that MySQL could be made to dereference a NULL pointer and divide by zero. An authenticated user could exploit this with a crafted IF clause, leading to a denial of service.
(CVE-2007-2583)

Victoria Reznichenko discovered that MySQL did not always require the DROP privilege. An authenticated user could exploit this via RENAME TABLE statements to rename arbitrary tables, possibly gaining additional database access. (CVE-2007-2691)

It was discovered that MySQL could be made to overflow a signed char during authentication. Remote attackers could use crafted authentication requests to cause a denial of service. (CVE-2007-3780)

Phil Anderton discovered that MySQL did not properly verify access privileges when accessing external tables. As a result, authenticated users could exploit this to obtain UPDATE privileges to external tables. (CVE-2007-3782)

In certain situations, when installing or upgrading mysql, there was no notification that the mysql root user password needed to be set. If the password was left unset, attackers would be able to obtain unrestricted access to mysql. This is now checked during mysql start-up.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update provides fixes for :

  - CVE-2007-3780: remote triggerable crash

  - CVE-2007-3781: query tables without propper     authorisation

  - CVE-2007-3782: gain update privileges without propper     authorisation

A vulnerability was found in MySQL's authentication protocol, making it possible for a remote unauthenticated attacker to send a specially crafted authentication request to the MySQL server causing it to crash (CVE-2007-3780).

Another flaw was discovered in MySQL that allowed remote authenticated users to gain update privileges for a table in another database via a view that refers to the external table (CVE-2007-3782).

Updated packages have been patched to prevent these issues.

Updated mysql packages that fix a security flaw are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries.

A flaw was discovered in MySQL's authentication protocol. It is possible for a remote unauthenticated attacker to send a specially crafted authentication request to the MySQL server causing it to crash. (CVE-2007-3780)

All users of the MySQL server are advised to upgrade to these updated packages, which contain a backported patch which fixes this issue.

The remote host is affected by the vulnerability described in GLSA-200708-10 (MySQL: Denial of Service and information leakage)

    Dormando reported a vulnerability within the handling of password     packets in the connection protocol (CVE-2007-3780). Andrei Elkin also     found that the 'CREATE TABLE LIKE' command didn't require SELECT     privileges on the source table (CVE-2007-3781).
  Impact :

    A remote unauthenticated attacker could use the first vulnerability to     make the server crash. The second vulnerability can be used by     authenticated users to obtain information on tables they are not     normally able to access.
  Workaround :

    There is no known workaround at this time.

The version of MySQL installed on the remote host is reportedly affected by a denial of service vulnerability that can lead to a server crash with a specially-crafted password packet.  It is also affected by a privilege escalation vulnerability because 'CREATE TABLE LIKE' does not require any privileges on the source table, which allows an attacker to create arbitrary tables using the affected application.

The version of MySQL Community Server installed on the remote host is reportedly affected by a denial of service vulnerability that can lead to a server crash with a specially crafted password packet. 

It is also affected by a privilege escalation vulnerability because 'CREATE TABLE LIKE' does not require any privileges on the source table, which allows an attacker to create arbitrary tables using the affected application.

ID	Name	Product	Family	Severity
67566	Oracle Linux 5 : Important: / mysql (ELSA-2007-0875)	Nessus	Oracle Linux Local Security Checks	high
60243	Scientific Linux Security Update : mysql on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
35335	FreeBSD : mysql -- remote dos via malformed password packet (240ac24c-dff3-11dd-a765-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium
29525	SuSE 10 Security Update : MySQL (ZYPP Patch Number 4376)	Nessus	SuSE Local Security Checks	medium
28133	Ubuntu 6.06 LTS / 6.10 / 7.04 : mysql-dfsg-5.0 vulnerabilities (USN-528-1)	Nessus	Ubuntu Local Security Checks	medium
27359	openSUSE 10 Security Update : mysql (mysql-4375)	Nessus	SuSE Local Security Checks	medium
26009	Mandrake Linux Security Advisory : MySQL (MDKSA-2007:177)	Nessus	Mandriva Local Security Checks	medium
25970	RHEL 4 / 5 : mysql (RHSA-2007:0875)	Nessus	Red Hat Local Security Checks	medium
25958	CentOS 4 / 5 : mysql (CESA-2007:0875)	Nessus	CentOS Local Security Checks	medium
25916	GLSA-200708-10 : MySQL: Denial of Service and information leakage	Nessus	Gentoo Local Security Checks	medium
4146	Oracle MySQL < 5.0.45 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
25759	MySQL Community Server 5.0 < 5.0.45 Multiple Vulnerabilities	Nessus	Databases	medium
801122	MySQL < 5.0.45 Multiple Vulnerabilities	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2007-3780

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium