MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mysql: over-sized packet denial of service vulnerability (CVE-2010-1849)

  - mysql: Unspecified vulnerability allows remote authenticated users to affect confidentiality     (CVE-2012-0484)

  - MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table     via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than     CVE-2008-4098 and CVE-2008-7247. (CVE-2010-1626)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Solaris system is missing necessary patches to address security updates :

  - MySQL before 5.0.67 allows local users to bypass certain     privilege checks by calling CREATE TABLE on a MyISAM     table with modified (1) DATA DIRECTORY or (2) INDEX     DIRECTORY arguments that are originally associated with     pathnames without symlinks, and that can point to tables     created at a future time at which a pathname is modified     to contain a symlink to a subdirectory of the MySQL home     data directory. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2008-4097. (CVE-2008-4098)

  - sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x     through 5.1.41, and 6.0 before 6.0.9-alpha, when the     data home directory contains a symlink to a different     filesystem, allows remote authenticated users to bypass     intended access restrictions by calling CREATE TABLE     with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY     argument referring to a subdirectory that requires     following this symlink. (CVE-2008-7247)

  - MySQL before 5.1.46 allows local users to delete the     data and index files of another user's MyISAM table via     a symlink attack in conjunction with the DROP TABLE     command, a different vulnerability than CVE-2008-4098     and CVE-2008-7247. (CVE-2010-1626)

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x     before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL     5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and     earlier allows remote attackers to cause a denial of     service (crash) via a crafted geometry feature that     specifies a large number of points, which is not     properly handled when processing the binary     representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0442 advisory.

    [5.0.77-4.3]
    - Add fixes for CVE-2010-1626, CVE-2010-1848, CVE-2010-1850

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A buffer overflow flaw was found in the way MySQL handled the parameters of the MySQL COM_FIELD_LIST network protocol command (this command is sent when a client uses the MySQL mysql_list_fields() client library function). An authenticated database user could send a request with an excessively long table name to cause a temporary denial of service (mysqld crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-1850)

A directory traversal flaw was found in the way MySQL handled the parameters of the MySQL COM_FIELD_LIST network protocol command. An authenticated database user could use this flaw to obtain descriptions of the fields of an arbitrary table using a request with a specially crafted table name. (CVE-2010-1848)

A flaw was discovered in the way MySQL handled symbolic links to tables created using the DATA DIRECTORY and INDEX DIRECTORY directives in CREATE TABLE statements. An attacker with CREATE and DROP table privileges, and shell access to the database server, could use this flaw to remove data and index files of tables created by other database users using the MyISAM storage engine. (CVE-2010-1626)

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201201-02 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MySQL. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may be able to execute arbitrary code       with the privileges of the MySQL process, cause a Denial of Service       condition, bypass security restrictions, uninstall arbitrary MySQL       plugins, or conduct Man-in-the-Middle and Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

The following bugs have been fixed :

  - local users could delete data files for tables of other     users. (CVE-2010-1626)

  - authenticated users could gather information for tables     they should not have access to. (CVE-2010-1849)

  - authenticated users could crash mysqld. (CVE-2010-1848)

  - authenticated users could potentially execute arbitrary     code as the user running mysqld. (CVE-2010-1850)

  - authenticated users could crash mysqld (CVE-2010-3677 /     CVE-2010-3678 / CVE-2010-3681 / CVE-2010-3682 /     CVE-2010-3683)

The following bugs have been fixed :

  - local users could delete data files for tables of other     users. (CVE-2010-1626)

  - authenticated users could gather information for tables     they should not have access to. (CVE-2010-1849)

  - authenticated users could crash mysqld. (CVE-2010-3683,     CVE-2010-3681, CVE-2010-1848)

  - authenticated users could bypass intended access     restrictions. (CVE-2008-7247, CVE-2009-4030)

- local users could delete data files for tables of other     users (CVE-2010-1626).

  - authenticated users could gather information for tables     they should not have access to (CVE-2010-1849)

  - authenticated users could crash mysqld (CVE-2010-1848)

  - authenticated users could potentially execute arbitrary     code as the user running mysqld (CVE-2010-1850)

  - authenticated users could crash mysqld (CVE-2010-3676,     CVE-2010-3677, CVE-2010-3678, CVE-2010-3679,     CVE-2010-3680, CVE-2010-3681, CVE-2010-3682,     CVE-2010-3683, CVE-2010-2008)

  - a race condition in /etc/init.d/mysql allowed local     users to make any file readable via symlink in /var/tmp     (CVE-2010-3675)

- local users could delete data files for tables of other     users (CVE-2010-1626).

  - authenticated users could gather information for tables     they should not have access to (CVE-2010-1849)

  - authenticated users could crash mysqld (CVE-2010-1848)

  - authenticated users could potentially execute arbitrary     code as the user running mysqld (CVE-2010-1850)

  - authenticated users could crash mysqld (CVE-2010-3677,     CVE-2010-3678, CVE-2010-3681, CVE-2010-3682,     CVE-2010-3683)

It was discovered that MySQL did not check privileges before uninstalling plugins. An authenticated user could uninstall arbitrary plugins, bypassing intended restrictions. This issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-1621)

It was discovered that MySQL could be made to delete another user's data and index files. An authenticated user could use symlinks combined with the DROP TABLE command to possibly bypass privilege checks. (CVE-2010-1626)

It was discovered that MySQL incorrectly validated the table name argument of the COM_FIELD_LIST command. An authenticated user could use a specially- crafted table name to bypass privilege checks and possibly access other tables. (CVE-2010-1848)

Eric Day discovered that MySQL incorrectly handled certain network packets. A remote attacker could exploit this flaw and cause the server to consume all available resources, resulting in a denial of service. (CVE-2010-1849)

It was discovered that MySQL performed incorrect bounds checking on the table name argument of the COM_FIELD_LIST command. An authenticated user could use a specially crafted table name to cause a denial of service or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2010-1850).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-1626     MySQL allows local users to delete the data and index     files of another user's MyISAM table via a symlink     attack in conjunction with the DROP TABLE command.

  - CVE-2010-1848     MySQL failed to check the table name argument of a     COM_FIELD_LIST command packet for validity and     compliance to acceptable table name standards. This     allows an authenticated user with SELECT privileges on     one table to obtain the field definitions of any table     in all other databases and potentially of other MySQL     instances accessible from the server's file system.

  - CVE-2010-1849     MySQL could be tricked to read packets indefinitely if     it received a packet larger than the maximum size of one     packet. This results in high CPU usage and thus denial     of service conditions.

  - CVE-2010-1850     MySQL was susceptible to a buffer-overflow attack due to     a failure to perform bounds checking on the table name     argument of a COM_FIELD_LIST command packet. By sending     long data for the table name, a buffer is overflown,     which could be exploited by an authenticated user to     inject malicious code.

Updated mysql packages that fix three security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

A buffer overflow flaw was found in the way MySQL handled the parameters of the MySQL COM_FIELD_LIST network protocol command (this command is sent when a client uses the MySQL mysql_list_fields() client library function). An authenticated database user could send a request with an excessively long table name to cause a temporary denial of service (mysqld crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-1850)

A directory traversal flaw was found in the way MySQL handled the parameters of the MySQL COM_FIELD_LIST network protocol command. An authenticated database user could use this flaw to obtain descriptions of the fields of an arbitrary table using a request with a specially crafted table name. (CVE-2010-1848)

A flaw was discovered in the way MySQL handled symbolic links to tables created using the DATA DIRECTORY and INDEX DIRECTORY directives in CREATE TABLE statements. An attacker with CREATE and DROP table privileges, and shell access to the database server, could use this flaw to remove data and index files of tables created by other database users using the MyISAM storage engine. (CVE-2010-1626)

All MySQL users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0442 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of     the MySQL server daemon (mysqld) and many client programs and libraries.

    A buffer overflow flaw was found in the way MySQL handled the parameters of     the MySQL COM_FIELD_LIST network protocol command (this command is sent     when a client uses the MySQL mysql_list_fields() client library function).
    An authenticated database user could send a request with an excessively     long table name to cause a temporary denial of service (mysqld crash) or,     potentially, execute arbitrary code with the privileges of the database     server. (CVE-2010-1850)

    A directory traversal flaw was found in the way MySQL handled the     parameters of the MySQL COM_FIELD_LIST network protocol command. An     authenticated database user could use this flaw to obtain descriptions of     the fields of an arbitrary table using a request with a specially-crafted     table name. (CVE-2010-1848)

    A flaw was discovered in the way MySQL handled symbolic links to tables     created using the DATA DIRECTORY and INDEX DIRECTORY directives in CREATE     TABLE statements. An attacker with CREATE and DROP table privileges, and     shell access to the database server, could use this flaw to remove data and     index files of tables created by other database users using the MyISAM     storage engine. (CVE-2010-1626)

    All MySQL users are advised to upgrade to these updated packages, which     contain backported patches to resolve these issues. After installing this     update, the MySQL server daemon (mysqld) will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability has been found and corrected in mysql :

It was possible for DROP TABLE of one MyISAM table to remove the data and index files of a different MyISAM table (CVE-2010-1626).

Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products.

The updated packages have been patched to correct this issue.

Versions of MySQL Community Server 5.1 earlier than 5.1.46 are potentially affected by the following vulnerabilities :

  - A local user may be able to issue a 'DROP TABLE' command for one MyISAM table and remove the data and index files of a different MyISAM table. (Bug #40980)

  - The application does not correct check privileges in calls to 'UNINSTALL PLUGIN', which could be abused by an unprivileged user to uninstall plugins loaded dynamically. (BUG #51770)

The version of MySQL Community Server 5.1 installed on the remote host is earlier than 5.1.46 and thus potentially affected by the following vulnerabilities :

  - A local user may be able to issue a 'DROP TABLE' command     for one MyISAM table and remove the data and index files     of a different MyISAM table. (Bug #40980)

  - The application does not correct check privileges in     calls to 'UNINSTALL PLUGIN', which could be abused by     an unprivileged user to uninstall plugins loaded     dynamically. (Bug #51770)

ID	Name	Product	Family	Severity
198586	RHEL 4 : mysql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
80705	Oracle Solaris Third-Party Patch Update : mysql (multiple_vulnerabilities_in_mysql)	Nessus	Solaris Local Security Checks	medium
68046	Oracle Linux 5 : mysql (ELSA-2010-0442)	Nessus	Oracle Linux Local Security Checks	critical
60796	Scientific Linux Security Update : mysql on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	high
57446	GLSA-201201-02 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50936	SuSE 11 / 11.1 Security Update : MySQL (SAT Patch Numbers 3220 / 3243)	Nessus	SuSE Local Security Checks	medium
50523	SuSE9 Security Update : MySQL (YOU Patch Number 12661)	Nessus	SuSE Local Security Checks	medium
50021	SuSE 10 Security Update : MySQL (ZYPP Patch Number 7172)	Nessus	SuSE Local Security Checks	medium
50016	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0730-1)	Nessus	SuSE Local Security Checks	medium
50010	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0731-1)	Nessus	SuSE Local Security Checks	medium
46855	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-950-1)	Nessus	Ubuntu Local Security Checks	medium
46832	Debian DSA-2057-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
46763	CentOS 5 : mysql (CESA-2010:0442)	Nessus	CentOS Local Security Checks	medium
46735	RHEL 5 : mysql (RHSA-2010:0442)	Nessus	Red Hat Local Security Checks	critical
46679	Mandriva Linux Security Advisory : mysql (MDVSA-2010:101)	Nessus	Mandriva Local Security Checks	low
801159	MySQL Community Server 5.1 < 5.1.46 Multiple Vulnerabilities	Log Correlation Engine	Database	low
5547	MySQL Community Server 5.1 < 5.1.46 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
46328	MySQL Community Server 5.1 < 5.1.46 Multiple Vulnerabilities	Nessus	Databases	low

Detections

Analytics

CVE-2010-1626

critical

Tenable Plugins

high

medium

critical

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

critical

low

low

medium

low