RHSA-2002:289 - Security Advisory

Topic

Updated packages are available for Red Hat Linux Advanced Server 2.1 that fix
security vulnerabilities found in the MySQL server.

[Updated 06 Feb 2003]
Added fixed packages for Advanced Workstation 2.1

Description

MySQL is a multi-user, multi-threaded SQL database server. While auditing
MySQL, Stefan Esser found security vulnerabilities that can be used to
crash the server or allow MySQL users to gain privileges.

A signed integer vulnerability in the COM_TABLE_DUMP package for MySQL
3.x to 3.23.53a, and 4.x to 4.0.5a, allows remote attackers to cause a
denial of service (crash or hang) in mysqld by causing large negative
integers to be provided to a memcpy call. (CAN-2002-1373)

The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a, and 4.x to
4.0.5a, allows a remote attacker to gain privileges via a brute force
attack using a one-character password, which causes MySQL to only compare
the provided password against the first character of the real
password. (CAN-2002-1374)

The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a, and 4.x to
4.0.5a, allows remote attackers to execute arbitrary code via a long
response. (CAN-2002-1375)

The MySQL client library (libmysqlclient) in MySQL 3.x to 3.23.53a, and 4.x
to 4.0.5a, does not properly verify length fields for certain responses
in the read_rows or read_one_row routines, which allows a malicious server
to cause a denial of service and possibly execute arbitrary
code. (CAN-2002-1376)

Red Hat Linux Advanced Server 2.1 contains versions of MySQL that are
vulnerable to these issues. All users of MySQL are advised to upgrade to
these errata packages containing MySQL 3.23.54a which is not vulnerable to
these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Please note that this update is available via Red Hat Network. To use Red
Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 2 ia64
• Red Hat Enterprise Linux Workstation 2 ia64

Fixes

CVEs

• CVE-2002-1376
• CVE-2002-1375
• CVE-2002-1374
• CVE-2002-1373

References

(none)