Buffer overflow in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to execute arbitrary code via a COM_FIELD_LIST command with a long table name.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0442 advisory.

    [5.0.77-4.3]
    - Add fixes for CVE-2010-1626, CVE-2010-1848, CVE-2010-1850

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A buffer overflow flaw was found in the way MySQL handled the parameters of the MySQL COM_FIELD_LIST network protocol command (this command is sent when a client uses the MySQL mysql_list_fields() client library function). An authenticated database user could send a request with an excessively long table name to cause a temporary denial of service (mysqld crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-1850)

A directory traversal flaw was found in the way MySQL handled the parameters of the MySQL COM_FIELD_LIST network protocol command. An authenticated database user could use this flaw to obtain descriptions of the fields of an arbitrary table using a request with a specially crafted table name. (CVE-2010-1848)

A flaw was discovered in the way MySQL handled symbolic links to tables created using the DATA DIRECTORY and INDEX DIRECTORY directives in CREATE TABLE statements. An attacker with CREATE and DROP table privileges, and shell access to the database server, could use this flaw to remove data and index files of tables created by other database users using the MyISAM storage engine. (CVE-2010-1626)

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201201-02 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MySQL. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may be able to execute arbitrary code       with the privileges of the MySQL process, cause a Denial of Service       condition, bypass security restrictions, uninstall arbitrary MySQL       plugins, or conduct Man-in-the-Middle and Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

The following bugs have been fixed :

  - local users could delete data files for tables of other     users. (CVE-2010-1626)

  - authenticated users could gather information for tables     they should not have access to. (CVE-2010-1849)

  - authenticated users could crash mysqld. (CVE-2010-1848)

  - authenticated users could potentially execute arbitrary     code as the user running mysqld. (CVE-2010-1850)

  - authenticated users could crash mysqld (CVE-2010-3677 /     CVE-2010-3678 / CVE-2010-3681 / CVE-2010-3682 /     CVE-2010-3683)

Versions of Mac OS X 10.6 earlier than 10.6.5 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server

  - Apache mod_perl

  - Apache

  - AppKit

  - ATS

  - CFNetwork

  - CoreGraphics

  - CoreText

  - CUPS

  - Directory Services

  - diskdev_cmds

Disk Images

  - Flash Player plug-in

  - gzip

  - Image Capture

  - ImageIO

  - Image RAW

  - Kernel

  - MySQL

  - neon

  - Networking

  - OpenLDAP

  - OpenSSL

  - Password Server

  - PHP

  - Printing

  - python

  - QuickLook

  - QuickTime

  - Safari RSS

  - Time Machine

  - Wiki Server

  - X11

  - xar

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-007 applied. 

This security update contains fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - ImageIO
  - Image RAW
  - MySQL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - Safari RSS
  - Wiki Server
  - X11

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.5.

Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - Apache
  - AppKit
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - Image Capture
  - ImageIO
  - Image RAW
  - Kernel
  - MySQL
  - neon
  - Networking
  - OpenLDAP
  - OpenSSL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - QuickTime
  - Safari RSS
  - Time Machine
  - Wiki Server
  - X11
  - xar

- local users could delete data files for tables of other     users (CVE-2010-1626).

  - authenticated users could gather information for tables     they should not have access to (CVE-2010-1849)

  - authenticated users could crash mysqld (CVE-2010-1848)

  - authenticated users could potentially execute arbitrary     code as the user running mysqld (CVE-2010-1850)

  - authenticated users could crash mysqld (CVE-2010-3676,     CVE-2010-3677, CVE-2010-3678, CVE-2010-3679,     CVE-2010-3680, CVE-2010-3681, CVE-2010-3682,     CVE-2010-3683, CVE-2010-2008)

  - a race condition in /etc/init.d/mysql allowed local     users to make any file readable via symlink in /var/tmp     (CVE-2010-3675)

- local users could delete data files for tables of other     users (CVE-2010-1626).

  - authenticated users could gather information for tables     they should not have access to (CVE-2010-1849)

  - authenticated users could crash mysqld (CVE-2010-1848)

  - authenticated users could potentially execute arbitrary     code as the user running mysqld (CVE-2010-1850)

  - authenticated users could crash mysqld (CVE-2010-3677,     CVE-2010-3678, CVE-2010-3681, CVE-2010-3682,     CVE-2010-3683)

Update to MySQL 5.1.47, for various fixes described at http://dev.mysql.com/doc/refman/5.1/en/news-5-1-47.html including fixes for CVE-2010-1848, CVE-2010-1849, CVE-2010-1850 In F13, also create mysql group explicitly in pre-server script, to ensure correct GID

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of MySQL server earlier than 5.1.47 / 5.0.91 are potentially affected by the following vulnerabilities :

  - The server may continue reading packets indefinitely if it receives a packet larger than the maximum size of one packet, which could allow an unauthenticated remote attacker to consume a high level of CPU and bandwidth. (Bug #50974)

  - Using an overly long table name argument to the 'COM_FIELD_LIST' command, an authenticated user can overflow a buffer and execute arbitrary code on the affected host. (Bug #53237)

  - Using a specially crafted table name argument to 'COM_FIELD_LIST', an authenticated user can bypass almost all forms of checks for privileges and table-level grants. (Bug #53371)

It was discovered that MySQL did not check privileges before uninstalling plugins. An authenticated user could uninstall arbitrary plugins, bypassing intended restrictions. This issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-1621)

It was discovered that MySQL could be made to delete another user's data and index files. An authenticated user could use symlinks combined with the DROP TABLE command to possibly bypass privilege checks. (CVE-2010-1626)

It was discovered that MySQL incorrectly validated the table name argument of the COM_FIELD_LIST command. An authenticated user could use a specially- crafted table name to bypass privilege checks and possibly access other tables. (CVE-2010-1848)

Eric Day discovered that MySQL incorrectly handled certain network packets. A remote attacker could exploit this flaw and cause the server to consume all available resources, resulting in a denial of service. (CVE-2010-1849)

It was discovered that MySQL performed incorrect bounds checking on the table name argument of the COM_FIELD_LIST command. An authenticated user could use a specially crafted table name to cause a denial of service or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2010-1850).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-1626     MySQL allows local users to delete the data and index     files of another user's MyISAM table via a symlink     attack in conjunction with the DROP TABLE command.

  - CVE-2010-1848     MySQL failed to check the table name argument of a     COM_FIELD_LIST command packet for validity and     compliance to acceptable table name standards. This     allows an authenticated user with SELECT privileges on     one table to obtain the field definitions of any table     in all other databases and potentially of other MySQL     instances accessible from the server's file system.

  - CVE-2010-1849     MySQL could be tricked to read packets indefinitely if     it received a packet larger than the maximum size of one     packet. This results in high CPU usage and thus denial     of service conditions.

  - CVE-2010-1850     MySQL was susceptible to a buffer-overflow attack due to     a failure to perform bounds checking on the table name     argument of a COM_FIELD_LIST command packet. By sending     long data for the table name, a buffer is overflown,     which could be exploited by an authenticated user to     inject malicious code.

Updated mysql packages that fix three security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

A buffer overflow flaw was found in the way MySQL handled the parameters of the MySQL COM_FIELD_LIST network protocol command (this command is sent when a client uses the MySQL mysql_list_fields() client library function). An authenticated database user could send a request with an excessively long table name to cause a temporary denial of service (mysqld crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-1850)

A directory traversal flaw was found in the way MySQL handled the parameters of the MySQL COM_FIELD_LIST network protocol command. An authenticated database user could use this flaw to obtain descriptions of the fields of an arbitrary table using a request with a specially crafted table name. (CVE-2010-1848)

A flaw was discovered in the way MySQL handled symbolic links to tables created using the DATA DIRECTORY and INDEX DIRECTORY directives in CREATE TABLE statements. An attacker with CREATE and DROP table privileges, and shell access to the database server, could use this flaw to remove data and index files of tables created by other database users using the MyISAM storage engine. (CVE-2010-1626)

All MySQL users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0442 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of     the MySQL server daemon (mysqld) and many client programs and libraries.

    A buffer overflow flaw was found in the way MySQL handled the parameters of     the MySQL COM_FIELD_LIST network protocol command (this command is sent     when a client uses the MySQL mysql_list_fields() client library function).
    An authenticated database user could send a request with an excessively     long table name to cause a temporary denial of service (mysqld crash) or,     potentially, execute arbitrary code with the privileges of the database     server. (CVE-2010-1850)

    A directory traversal flaw was found in the way MySQL handled the     parameters of the MySQL COM_FIELD_LIST network protocol command. An     authenticated database user could use this flaw to obtain descriptions of     the fields of an arbitrary table using a request with a specially-crafted     table name. (CVE-2010-1848)

    A flaw was discovered in the way MySQL handled symbolic links to tables     created using the DATA DIRECTORY and INDEX DIRECTORY directives in CREATE     TABLE statements. An attacker with CREATE and DROP table privileges, and     shell access to the database server, could use this flaw to remove data and     index files of tables created by other database users using the MyISAM     storage engine. (CVE-2010-1626)

    All MySQL users are advised to upgrade to these updated packages, which     contain backported patches to resolve these issues. After installing this     update, the MySQL server daemon (mysqld) will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in mysql :

The server failed to check the table name argument of a COM_FIELD_LIST command packet for validity and compliance to acceptable table name standards. This could be exploited to bypass almost all forms of checks for privileges and table-level grants by providing a specially crafted table name argument to COM_FIELD_LIST (CVE-2010-1848).

The server could be tricked into reading packets indefinitely if it received a packet larger than the maximum size of one packet CVE-2010-1849).

The server was susceptible to a buffer-overflow attack due to a failure to perform bounds checking on the table name argument of a COM_FIELD_LIST command packet. By sending long data for the table name, a buffer is overflown, which could be exploited by an authenticated user to inject malicious code (CVE-2010-1850).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

The version of MySQL Community Server installed on the remote host is earlier than 5.1.47 / 5.0.91 and is, therefore, potentially affected by the following vulnerabilities :

  - The server may continue reading packets indefinitely     if it receives a packet larger than the maximum size     of one packet, which could allow an unauthenticated,     remote attacker to consume a high level of CPU     and bandwidth. (Bug #50974)

  - Using an overly long table name argument to the     'COM_FIELD_LIST' command, an authenticated user can     overflow a buffer and execute arbitrary code on the     affected host. (Bug #53237)

  - Using a specially crafted table name argument to     'COM_FIELD_LIST', an authenticated user can bypass     almost all forms of checks for privileges and table-     level grants. (Bug #53371)

ID	Name	Product	Family	Severity
68046	Oracle Linux 5 : mysql (ELSA-2010-0442)	Nessus	Oracle Linux Local Security Checks	critical
60796	Scientific Linux Security Update : mysql on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	high
57446	GLSA-201201-02 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50936	SuSE 11 / 11.1 Security Update : MySQL (SAT Patch Numbers 3220 / 3243)	Nessus	SuSE Local Security Checks	medium
5705	Mac OS X 10.6 < 10.6.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
50549	Mac OS X Multiple Vulnerabilities (Security Update 2010-007)	Nessus	MacOS X Local Security Checks	critical
50548	Mac OS X 10.6.x < 10.6.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
50021	SuSE 10 Security Update : MySQL (ZYPP Patch Number 7172)	Nessus	SuSE Local Security Checks	medium
50016	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0730-1)	Nessus	SuSE Local Security Checks	medium
50010	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0731-1)	Nessus	SuSE Local Security Checks	medium
47523	Fedora 11 : mysql-5.1.47-1.fc11 (2010-9061)	Nessus	Fedora Local Security Checks	medium
47522	Fedora 12 : mysql-5.1.47-1.fc12 (2010-9053)	Nessus	Fedora Local Security Checks	medium
47519	Fedora 13 : mysql-5.1.47-1.fc13 (2010-9016)	Nessus	Fedora Local Security Checks	medium
801133	MySQL Community Server < 5.1.47 / 5.0.91 Multiple Vulnerabilities	Log Correlation Engine	Database	medium
5587	MySQL Community Server < 5.1.47 / 5.0.91 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
46855	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-950-1)	Nessus	Ubuntu Local Security Checks	medium
46832	Debian DSA-2057-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
46763	CentOS 5 : mysql (CESA-2010:0442)	Nessus	CentOS Local Security Checks	medium
46735	RHEL 5 : mysql (RHSA-2010:0442)	Nessus	Red Hat Local Security Checks	critical
46726	Mandriva Linux Security Advisory : mysql (MDVSA-2010:107)	Nessus	Mandriva Local Security Checks	medium
46702	MySQL Community Server < 5.1.47 / 5.0.91 Multiple Vulnerabilities	Nessus	Databases	medium

Detections

Analytics

CVE-2010-1850

critical

Tenable Plugins

critical

medium

high

high

medium

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium