MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement.

Information about these advisories is available at the following locations :

The version of MySQL installed on the remote host is earlier than 5.0.51a / 5.1.23 / 6.0.4 and thus reportedly affected by the following two vulnerabilities :

  - An attacker may be able to cause the federated handler     and daemon to crash when the federated engine issues a     SHOW TABLE STATUS LIKE query by having a malicious     server return a response with less than 14 columns.
    (MySQL bug #29801 / CVE-2007-6304)

  - It fails to update the DEFINER value of a view when that     is altered, which could allow an authenticated user to     gain additional access through the ALTER VIEW. (MySQL     bug #29908 / CVE-2007-6303)

This update fixes several security vulnerabilities (note: not all versions are affected by every bug) :

  - CVE-2007-2583

  - CVE-2007-2691

  - CVE-2007-2692

  - CVE-2007-5925

  - CVE-2007-5969

  - CVE-2007-6303

  - CVE-2007-6304

MySQL 5.0.x did not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement (CVE-2007-6303).

The federated engine in MySQL 5.0.x, when performing a certain SHOW TABLE STATUS query, did not properly handle a response with a small number of columns, which could allow a remote MySQL server to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns (CVE-2007-6304).

The updated packages have been patched to correct these issues.

The mysql_change_db() function in MySQL 5.0.x before 5.0.40 did not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allowed remote authenticated users to gain privileges (CVE-2007-2692).

The federated engine in MySQL 5.0.x, when performing a certain SHOW TABLE STATUS query, did not properly handle a response with a small number of columns, which could allow a remote MySQL server to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns (CVE-2007-6304).

The updated packages provide MySQL 5.0.45 for all Mandriva Linux platforms that shipped with MySQL 5.0.x which offers a number of feature enhancements and bug fixes. In addition, the updates for Corporate Server 4.0 include support for the Sphinx engine.

Please note that due to the package name change (from 'MySQL' to 'mysql'), the mysqld service will not restart automatically so users must execute 'service mysqld start' after the upgrade is complete.

The remote host is affected by the vulnerability described in GLSA-200804-04 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in MySQL:
    Mattias Jonsson reported that a 'RENAME TABLE' command against a     table with explicit 'DATA DIRECTORY' and 'INDEX DIRECTORY' options     would overwrite the file to which the symlink points     (CVE-2007-5969).
    Martin Friebe discovered that MySQL does not     update the DEFINER value of a view when the view is altered     (CVE-2007-6303).
    Philip Stoev discovered that the federated     engine expects the response of a remote MySQL server to contain a     minimum number of columns in query replies (CVE-2007-6304).
  Impact :

    An authenticated remote attacker could exploit the first vulnerability     to overwrite MySQL system tables and escalate privileges, or use the     second vulnerability to gain privileges via an 'ALTER VIEW' statement.
    Remote federated MySQL servers could cause a Denial of Service in the     local MySQL server by exploiting the third vulnerability.
  Workaround :

    There is no known workaround at this time.

USN-588-1 fixed vulnerabilities in MySQL. In fixing CVE-2007-2692 for Ubuntu 6.06, additional improvements were made to make privilege checks more restictive. As a result, an upstream bug was exposed which could cause operations on tables or views in a different database to fail. This update fixes the problem.

We apologize for the inconvenience.

Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232)

Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges. This issue does not affect Ubuntu 7.10. (CVE-2007-2692)

Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303)

Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232)

Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges.
This issue does not affect Ubuntu 7.10. (CVE-2007-2692)

Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303)

Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes several security vulnerabilities (note: not all versions are affected by every bug) :

  - CVE-2007-2583 

  - CVE-2007-2691 

  - CVE-2007-2692 

  - CVE-2007-5925 

  - CVE-2007-5969 

  - CVE-2007-6303 

  - CVE-2007-6304

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-1157.

- Thu Dec 13 2007 Tom Lane <tgl at redhat.com> 5.0.45-6

    - Back-port upstream fixes for CVE-2007-5925,       CVE-2007-5969, CVE-2007-6303. Related: #422211

  - Update License tag to match code.

    - Sun Jul 22 2007 Tom Lane <tgl at redhat.com> 5.0.45-1

    - Update to MySQL 5.0.45 Resolves: #246535

  - Move mysql_config's man page to base package Resolves:
    #245770

  - move my_print_defaults to base RPM, for consistency with     Stacks packaging

    - mysql user is no longer deleted at RPM uninstall       Resolves: #241912

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Dec 13 2007 Tom Lane <tgl at redhat.com> 5.0.45-6

    - Back-port upstream fixes for CVE-2007-5925,       CVE-2007-5969, CVE-2007-6303. Related: #422211

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL Server installed on the remote host reportedly is affected by the following issues :

 - It is possible, by creating a partitioned table using the DATA DIRECTORY and INDEX DIRECTORY options, to gain privileges on other tables having the same name as the partitioned table. (Bug #32091)

 - Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information. (Bug #32111).

 - ALTER VIEW retains the original DEFINER value, even when altered by another user, which can allow that user to gain the access rights of the view. (Bug #29908)

 - When using a FEDERATED table, the local server can be forced to crash if the remote server returns a result with fewer columns than expected. (Bug #29801)

The version of MySQL Enterprise Server installed on the remote host reportedly is affected by the following issues :

 - Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information. (Bug #32111).

 - ALTER VIEW retained the original DEFINER value, even when altered by another user, which could allow that user to gain the access rights of the view. (Bug #29908)

 - When using a FEDERATED table, the local server can be forced to crash if the remote server returns a result with fewer columns than expected. (Bug #29801)

The version of MySQL Enterprise Server 5.0 installed on the remote host is earlier than 5.0.52.  Such versions reportedly are affected by the following issues :

  - Using RENAME TABLE against a table with explicit DATA     DIRECTORY and INDEX DIRECTORY options can be used to     overwrite system table information. (Bug #32111).

  - ALTER VIEW retained the original DEFINER value, even     when altered by another user, which could allow that     user to gain the access rights of the view. (Bug     #29908)

  - When using a FEDERATED table, the local server can be     forced to crash if the remote server returns a result     with fewer columns than expected. (Bug #29801)

The version of MySQL Server installed on the remote host reportedly is affected by the following issues :

  - It is possible, by creating a partitioned table using     the DATA DIRECTORY and INDEX DIRECTORY options, to gain     privileges on other tables having the same name as the     partitioned table. (Bug #32091)

  - Using RENAME TABLE against a table with explicit DATA     DIRECTORY and INDEX DIRECTORY options can be used to     overwrite system table information. (Bug #32111).

  - ALTER VIEW retains the original DEFINER value, even     when altered by another user, which can allow that     user to gain the access rights of the view. (Bug     #29908)

  - When using a FEDERATED table, the local server can be     forced to crash if the remote server returns a result     with fewer columns than expected. (Bug #29801)

ID	Name	Product	Family	Severity
78218	F5 Networks BIG-IP : MySQL vulnerabilities (SOL8178)	Nessus	F5 Networks Local Security Checks	high
17813	MySQL < 5.0.51a / 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus	Databases	medium
41184	SuSE9 Security Update : MySQL (YOU Patch Number 12044)	Nessus	SuSE Local Security Checks	high
36404	Mandriva Linux Security Advisory : mysql (MDVSA-2008:017)	Nessus	Mandriva Local Security Checks	medium
36399	Mandriva Linux Security Advisory : mysql (MDVSA-2008:028)	Nessus	Mandriva Local Security Checks	medium
31835	GLSA-200804-04 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
31783	Ubuntu 6.06 LTS : mysql-dfsg-5.0 regression (USN-588-2)	Nessus	Ubuntu Local Security Checks	high
31638	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mysql-dfsg-5.0 vulnerabilities (USN-588-1)	Nessus	Ubuntu Local Security Checks	high
30182	SuSE 10 Security Update : MySQL (ZYPP Patch Number 4879)	Nessus	SuSE Local Security Checks	high
30180	openSUSE 10 Security Update : libmysqlclient-devel (libmysqlclient-devel-4873)	Nessus	SuSE Local Security Checks	high
29752	CentOS 4 : mysql (CESA-2007:1222-001)	Nessus	CentOS Local Security Checks	high
29714	Fedora 7 : mysql-5.0.45-6.fc7 (2007-4471)	Nessus	Fedora Local Security Checks	high
29712	Fedora 8 : mysql-5.0.45-6.fc8 (2007-4465)	Nessus	Fedora Local Security Checks	high
4313	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
4312	Oracle MySQL Enterprise Server < 5.0.52 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
29346	MySQL Enterprise Server 5.0 < 5.0.52 Multiple Vulnerabilities	Nessus	Databases	medium
29345	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus	Databases	medium
801147	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Log Correlation Engine	Database	medium
801138	MySQL Enterprise Server < 5.0.52 Multiple Vulnerabilities	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2007-6303

high

Tenable Plugins

high

medium

high

medium

medium

high

high

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium