The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and earlier allows remote authenticated users to cause a denial of service (database crash) via a certain CONTAINS operation on an indexed column, which triggers an assertion error.

Information about these advisories is available at the following locations :

From Red Hat Security Advisory 2007:1155 :

Updated mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld), and many different client programs and libraries.

A flaw was found in a way MySQL handled symbolic links when database tables were created with explicit 'DATA' and 'INDEX DIRECTORY' options. An authenticated user could create a table that would overwrite tables in other databases, causing destruction of data or allowing the user to elevate privileges. (CVE-2007-5969)

A flaw was found in a way MySQL's InnoDB engine handled spatial indexes. An authenticated user could create a table with spatial indexes, which are not supported by the InnoDB engine, that would cause the mysql daemon to crash when used. This issue only causes a temporary denial of service, as the mysql daemon will be automatically restarted after the crash. (CVE-2007-5925)

All mysql users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

A flaw was found in a way MySQL handled symbolic links when database tables were created with explicit 'DATA' and 'INDEX DIRECTORY' options. An authenticated user could create a table that would overwrite tables in other databases, causing destruction of data or allowing the user to elevate privileges. (CVE-2007-5969)

A flaw was found in a way MySQL's InnoDB engine handled spatial indexes. An authenticated user could create a table with spatial indexes, which are not supported by the InnoDB engine, that would cause the mysql daemon to crash when used. This issue only causes a temporary denial of service, as the mysql daemon will be automatically restarted after the crash. (CVE-2007-5925)

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL installed on the remote host is older than 5.0.54, 5.1.23 or 6.0.4. 

A remote attacker could crash the server by exploiting a flaw in InnoDB code.

This update fixes several security vulnerabilities (note: not all versions are affected by every bug) :

  - CVE-2007-2583

  - CVE-2007-2691

  - CVE-2007-2692

  - CVE-2007-5925

  - CVE-2007-5969

  - CVE-2007-6303

  - CVE-2007-6304

This update fixes several security vulnerabilities (note: not all versions are affected by every bug) :

  - CVE-2007-2583 

  - CVE-2007-2691 

  - CVE-2007-2692 

  - CVE-2007-5925 

  - CVE-2007-5969 

  - CVE-2007-6303 

  - CVE-2007-6304

Joe Gallo and Artem Russakovskii discovered that the InnoDB engine in MySQL did not properly perform input validation. An authenticated user could use a crafted CONTAINS statement to cause a denial of service.
(CVE-2007-5925)

It was discovered that under certain conditions MySQL could be made to overwrite system table information. An authenticated user could use a crafted RENAME statement to escalate privileges. (CVE-2007-5969)

Philip Stoev discovered that the the federated engine of MySQL did not properly handle responses with a small number of columns. An authenticated user could use a crafted response to a SHOW TABLE STATUS query and cause a denial of service. (CVE-2007-6304)

It was discovered that MySQL did not properly enforce access controls.
An authenticated user could use a crafted CREATE TABLE LIKE statement to escalate privileges. (CVE-2007-3781).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-1157.

Updated mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld), and many different client programs and libraries.

A flaw was found in a way MySQL handled symbolic links when database tables were created with explicit 'DATA' and 'INDEX DIRECTORY' options. An authenticated user could create a table that would overwrite tables in other databases, causing destruction of data or allowing the user to elevate privileges. (CVE-2007-5969)

A flaw was found in a way MySQL's InnoDB engine handled spatial indexes. An authenticated user could create a table with spatial indexes, which are not supported by the InnoDB engine, that would cause the mysql daemon to crash when used. This issue only causes a temporary denial of service, as the mysql daemon will be automatically restarted after the crash. (CVE-2007-5925)

All mysql users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

- Thu Dec 13 2007 Tom Lane <tgl at redhat.com> 5.0.45-6

    - Back-port upstream fixes for CVE-2007-5925,       CVE-2007-5969, CVE-2007-6303. Related: #422211

  - Update License tag to match code.

    - Sun Jul 22 2007 Tom Lane <tgl at redhat.com> 5.0.45-1

    - Update to MySQL 5.0.45 Resolves: #246535

  - Move mysql_config's man page to base package Resolves:
    #245770

  - move my_print_defaults to base RPM, for consistency with     Stacks packaging

    - mysql user is no longer deleted at RPM uninstall       Resolves: #241912

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Dec 13 2007 Tom Lane <tgl at redhat.com> 5.0.45-6

    - Back-port upstream fixes for CVE-2007-5925,       CVE-2007-5969, CVE-2007-6303. Related: #422211

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New mysql packages are available for Slackware 11.0, 12.0, and
-current to fix bugs and security issues.

The version of MySQL Server installed on the remote host reportedly is affected by the following issues :

  - It is possible, by creating a partitioned table using     the DATA DIRECTORY and INDEX DIRECTORY options, to gain     privileges on other tables having the same name as the     partitioned table. (Bug #32091)

  - Using RENAME TABLE against a table with explicit DATA     DIRECTORY and INDEX DIRECTORY options can be used to     overwrite system table information. (Bug #32111).

  - ALTER VIEW retains the original DEFINER value, even     when altered by another user, which can allow that     user to gain the access rights of the view. (Bug     #29908)

  - When using a FEDERATED table, the local server can be     forced to crash if the remote server returns a result     with fewer columns than expected. (Bug #29801)

A vulnerability in MySQL prior to 5.0.45 did not require priveliges such as SELECT for the source table in a CREATE TABLE LIKE statement, allowing remote authenticated users to obtain sensitive information such as the table structure (CVE-2007-3781).

A vulnerability in the InnoDB engine in MySQL allowed remote authenticated users to cause a denial of service (database crash) via certain CONTAINS operations on an indexed column, which triggered an assertion error (CVE-2007-5925).

Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options could be used to overwrite system table information by replacing the file to which a symlink pointed to (CVE-2007-5969).

The updated packages have been patched to correct these issues.

Several vulnerabilities have been found in the MySQL database packages with implications ranging from unauthorized database modifications to remotely triggered server crashes. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2583     The in_decimal::set function in item_cmpfunc.cc in MySQL     before 5.0.40 allows context-dependent attackers to     cause a denial of service (crash) via a crafted IF     clause that results in a divide-by-zero error and a NULL     pointer dereference. (Affects source version 5.0.32.)

  - CVE-2007-2691     MySQL does not require the DROP privilege for RENAME     TABLE statements, which allows remote authenticated     users to rename arbitrary tables. (All supported     versions affected.)

  - CVE-2007-2692     The mysql_change_db function does not restore     THD::db_access privileges when returning from SQL     SECURITY INVOKER stored routines, which allows remote     authenticated users to gain privileges. (Affects source     version 5.0.32.)

  - CVE-2007-3780     MySQL could be made to overflow a signed char during     authentication. Remote attackers could use specially     crafted authentication requests to cause a denial of     service. (Upstream source versions 4.1.11a and 5.0.32     affected.)

  - CVE-2007-3782     Phil Anderton discovered that MySQL did not properly     verify access privileges when accessing external tables.
    As a result, authenticated users could exploit this to     obtain UPDATE privileges to external tables. (Affects     source version 5.0.32.)

  - CVE-2007-5925     The convert_search_mode_to_innobase function in     ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and     earlier allows remote authenticated users to cause a     denial of service (database crash) via a certain     CONTAINS operation on an indexed column, which triggers     an assertion error. (Affects source version 5.0.32.)

The remote host is affected by the vulnerability described in GLSA-200711-25 (MySQL: Denial of Service)

    Joe Gallo and Artem Russakovskii reported an error in the     convert_search_mode_to_innobase() function in ha_innodb.cc in the     InnoDB engine that is leading to a failed assertion when handling     CONTAINS operations.
  Impact :

    A remote authenticated attacker with ALTER privileges could send a     specially crafted request to a vulnerable database server possibly     leading to a Denial of Service.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
78218	F5 Networks BIG-IP : MySQL vulnerabilities (SOL8178)	Nessus	F5 Networks Local Security Checks	high
67624	Oracle Linux 4 / 5 : mysql (ELSA-2007-1155)	Nessus	Oracle Linux Local Security Checks	high
60332	Scientific Linux Security Update : mysql on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	high
17833	MySQL < 5.0.54 / 5.1.23 / 6.0.4 Denial of Service	Nessus	Databases	medium
41184	SuSE9 Security Update : MySQL (YOU Patch Number 12044)	Nessus	SuSE Local Security Checks	high
30182	SuSE 10 Security Update : MySQL (ZYPP Patch Number 4879)	Nessus	SuSE Local Security Checks	high
30180	openSUSE 10 Security Update : libmysqlclient-devel (libmysqlclient-devel-4873)	Nessus	SuSE Local Security Checks	high
29793	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mysql-dfsg-5.0 vulnerabilities (USN-559-1)	Nessus	Ubuntu Local Security Checks	high
29752	CentOS 4 : mysql (CESA-2007:1222-001)	Nessus	CentOS Local Security Checks	high
29737	RHEL 4 / 5 : mysql (RHSA-2007:1155)	Nessus	Red Hat Local Security Checks	high
29731	CentOS 4 / 5 : mysql (CESA-2007:1155)	Nessus	CentOS Local Security Checks	high
29714	Fedora 7 : mysql-5.0.45-6.fc7 (2007-4471)	Nessus	Fedora Local Security Checks	high
29712	Fedora 8 : mysql-5.0.45-6.fc8 (2007-4465)	Nessus	Fedora Local Security Checks	high
29704	Slackware 11.0 / 12.0 / current : mysql (SSA:2007-348-01)	Nessus	Slackware Local Security Checks	high
29345	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus	Databases	medium
29300	Mandrake Linux Security Advisory : MySQL (MDKSA-2007:243)	Nessus	Mandriva Local Security Checks	high
28336	Debian DSA-1413-1 : mysql - multiple vulnerabilities	Nessus	Debian Local Security Checks	medium
28264	GLSA-200711-25 : MySQL: Denial of Service	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2007-5925

medium

Tenable Plugins

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

medium

high

medium

medium