The federated engine in MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4, when performing a certain SHOW TABLE STATUS query, allows remote MySQL servers to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns.

The version of MySQL installed on the remote host is earlier than 5.0.51a / 5.1.23 / 6.0.4 and thus reportedly affected by the following two vulnerabilities :

  - An attacker may be able to cause the federated handler     and daemon to crash when the federated engine issues a     SHOW TABLE STATUS LIKE query by having a malicious     server return a response with less than 14 columns.
    (MySQL bug #29801 / CVE-2007-6304)

  - It fails to update the DEFINER value of a view when that     is altered, which could allow an authenticated user to     gain additional access through the ALTER VIEW. (MySQL     bug #29908 / CVE-2007-6303)

This update fixes several security vulnerabilities (note: not all versions are affected by every bug) :

  - CVE-2007-2583

  - CVE-2007-2691

  - CVE-2007-2692

  - CVE-2007-5925

  - CVE-2007-5969

  - CVE-2007-6303

  - CVE-2007-6304

MySQL 5.0.x did not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement (CVE-2007-6303).

The federated engine in MySQL 5.0.x, when performing a certain SHOW TABLE STATUS query, did not properly handle a response with a small number of columns, which could allow a remote MySQL server to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns (CVE-2007-6304).

The updated packages have been patched to correct these issues.

The mysql_change_db() function in MySQL 5.0.x before 5.0.40 did not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allowed remote authenticated users to gain privileges (CVE-2007-2692).

The federated engine in MySQL 5.0.x, when performing a certain SHOW TABLE STATUS query, did not properly handle a response with a small number of columns, which could allow a remote MySQL server to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns (CVE-2007-6304).

The updated packages provide MySQL 5.0.45 for all Mandriva Linux platforms that shipped with MySQL 5.0.x which offers a number of feature enhancements and bug fixes. In addition, the updates for Corporate Server 4.0 include support for the Sphinx engine.

Please note that due to the package name change (from 'MySQL' to 'mysql'), the mysqld service will not restart automatically so users must execute 'service mysqld start' after the upgrade is complete.

The remote host is affected by the vulnerability described in GLSA-200804-04 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in MySQL:
    Mattias Jonsson reported that a 'RENAME TABLE' command against a     table with explicit 'DATA DIRECTORY' and 'INDEX DIRECTORY' options     would overwrite the file to which the symlink points     (CVE-2007-5969).
    Martin Friebe discovered that MySQL does not     update the DEFINER value of a view when the view is altered     (CVE-2007-6303).
    Philip Stoev discovered that the federated     engine expects the response of a remote MySQL server to contain a     minimum number of columns in query replies (CVE-2007-6304).
  Impact :

    An authenticated remote attacker could exploit the first vulnerability     to overwrite MySQL system tables and escalate privileges, or use the     second vulnerability to gain privileges via an 'ALTER VIEW' statement.
    Remote federated MySQL servers could cause a Denial of Service in the     local MySQL server by exploiting the third vulnerability.
  Workaround :

    There is no known workaround at this time.

Several local/remote vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3781     It was discovered that the privilege validation for the     source table of CREATE TABLE LIKE statements was     insufficiently enforced, which might lead to information     disclosure. This is only exploitable by authenticated     users.

  - CVE-2007-5969     It was discovered that symbolic links were handled     insecurely during the creation of tables with DATA     DIRECTORY or INDEX DIRECTORY statements, which might     lead to denial of service by overwriting data. This is     only exploitable by authenticated users.

  - CVE-2007-6304     It was discovered that queries to data in a FEDERATED     table can lead to a crash of the local database server,     if the remote server returns information with less     columns than expected, resulting in denial of service.

Joe Gallo and Artem Russakovskii discovered that the InnoDB engine in MySQL did not properly perform input validation. An authenticated user could use a crafted CONTAINS statement to cause a denial of service.
(CVE-2007-5925)

It was discovered that under certain conditions MySQL could be made to overwrite system table information. An authenticated user could use a crafted RENAME statement to escalate privileges. (CVE-2007-5969)

Philip Stoev discovered that the the federated engine of MySQL did not properly handle responses with a small number of columns. An authenticated user could use a crafted response to a SHOW TABLE STATUS query and cause a denial of service. (CVE-2007-6304)

It was discovered that MySQL did not properly enforce access controls.
An authenticated user could use a crafted CREATE TABLE LIKE statement to escalate privileges. (CVE-2007-3781).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL Server installed on the remote host reportedly is affected by the following issues :

 - It is possible, by creating a partitioned table using the DATA DIRECTORY and INDEX DIRECTORY options, to gain privileges on other tables having the same name as the partitioned table. (Bug #32091)

 - Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information. (Bug #32111).

 - ALTER VIEW retains the original DEFINER value, even when altered by another user, which can allow that user to gain the access rights of the view. (Bug #29908)

 - When using a FEDERATED table, the local server can be forced to crash if the remote server returns a result with fewer columns than expected. (Bug #29801)

The version of MySQL Enterprise Server installed on the remote host reportedly is affected by the following issues :

 - Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information. (Bug #32111).

 - ALTER VIEW retained the original DEFINER value, even when altered by another user, which could allow that user to gain the access rights of the view. (Bug #29908)

 - When using a FEDERATED table, the local server can be forced to crash if the remote server returns a result with fewer columns than expected. (Bug #29801)

The version of MySQL Enterprise Server 5.0 installed on the remote host is earlier than 5.0.52.  Such versions reportedly are affected by the following issues :

  - Using RENAME TABLE against a table with explicit DATA     DIRECTORY and INDEX DIRECTORY options can be used to     overwrite system table information. (Bug #32111).

  - ALTER VIEW retained the original DEFINER value, even     when altered by another user, which could allow that     user to gain the access rights of the view. (Bug     #29908)

  - When using a FEDERATED table, the local server can be     forced to crash if the remote server returns a result     with fewer columns than expected. (Bug #29801)

The version of MySQL Server installed on the remote host reportedly is affected by the following issues :

  - It is possible, by creating a partitioned table using     the DATA DIRECTORY and INDEX DIRECTORY options, to gain     privileges on other tables having the same name as the     partitioned table. (Bug #32091)

  - Using RENAME TABLE against a table with explicit DATA     DIRECTORY and INDEX DIRECTORY options can be used to     overwrite system table information. (Bug #32111).

  - ALTER VIEW retains the original DEFINER value, even     when altered by another user, which can allow that     user to gain the access rights of the view. (Bug     #29908)

  - When using a FEDERATED table, the local server can be     forced to crash if the remote server returns a result     with fewer columns than expected. (Bug #29801)

ID	Name	Product	Family	Severity
17813	MySQL < 5.0.51a / 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus	Databases	medium
41184	SuSE9 Security Update : MySQL (YOU Patch Number 12044)	Nessus	SuSE Local Security Checks	high
36404	Mandriva Linux Security Advisory : mysql (MDVSA-2008:017)	Nessus	Mandriva Local Security Checks	medium
36399	Mandriva Linux Security Advisory : mysql (MDVSA-2008:028)	Nessus	Mandriva Local Security Checks	medium
31835	GLSA-200804-04 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
30182	SuSE 10 Security Update : MySQL (ZYPP Patch Number 4879)	Nessus	SuSE Local Security Checks	high
29860	Debian DSA-1451-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	high
29793	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mysql-dfsg-5.0 vulnerabilities (USN-559-1)	Nessus	Ubuntu Local Security Checks	high
4313	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
4312	Oracle MySQL Enterprise Server < 5.0.52 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
29346	MySQL Enterprise Server 5.0 < 5.0.52 Multiple Vulnerabilities	Nessus	Databases	medium
29345	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus	Databases	medium
801147	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Log Correlation Engine	Database	medium
801138	MySQL Enterprise Server < 5.0.52 Multiple Vulnerabilities	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2007-6304

high

Tenable Plugins

medium

high

medium

medium

high

high

high

high

medium

medium

medium

medium

medium

medium