Synopsis

mysql security update

Type/Severity

Security Advisory: Low

Topic

Updated mysql packages that fix a temporary file flaw and a number of bugs
are now available.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a
client/server implementation consisting of a server daemon (mysqld)
and many different client programs and libraries.

An insecure temporary file handling bug was found in the mysql_install_db
script. It is possible for a local user to create specially crafted files
in /tmp which could allow them to execute arbitrary SQL commands during
database installation. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-1636 to this issue.

These packages update mysql to version 4.1.12, fixing a number of problems.
Also, support for SSL-encrypted connections to the database server is now
provided.

All users of mysql are advised to upgrade to these updated packages.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 158688 - CAN-2005-1636 mysql insecure temporary file creation
• BZ - 163694 - Parser issue with subqueries involving unions

CVEs

• CVE-2005-1636

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
mysql-4.1.12-3.RHEL4.1.src.rpm	SHA-256: 975eabf2b91a4edbf24067115658a495567a1f445d02b9ef101f8ff12109823a
x86_64
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: bd746a198acc0a546c46413b0ddc01e4b387172d8c9fd9825ad8d549760d26f9
mysql-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: bd746a198acc0a546c46413b0ddc01e4b387172d8c9fd9825ad8d549760d26f9
mysql-bench-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: b0c563037ba75b46ab6792023ff612b310ce0a90cb0b88e5a26ad6760c7ef897
mysql-bench-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: b0c563037ba75b46ab6792023ff612b310ce0a90cb0b88e5a26ad6760c7ef897
mysql-devel-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: 21b94cbece2b25c6f5cb2589359cd217acf6ca1610537a4460dfec49b380bdd6
mysql-devel-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: 21b94cbece2b25c6f5cb2589359cd217acf6ca1610537a4460dfec49b380bdd6
mysql-server-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: 0fd7c7464a76f7de4665ea8c1ea30cd23173d8d4fbb89a401d78c6e8b158b9a5
mysql-server-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: 0fd7c7464a76f7de4665ea8c1ea30cd23173d8d4fbb89a401d78c6e8b158b9a5
ia64
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: 04a536fa47d9ab611c54a9b19f782e572c98b53511de57552176fd8c856892f5
mysql-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: 04a536fa47d9ab611c54a9b19f782e572c98b53511de57552176fd8c856892f5
mysql-bench-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: b48480555c097d689baec5b6e8961320683be9811490b156f08a190f12b4ac4f
mysql-bench-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: b48480555c097d689baec5b6e8961320683be9811490b156f08a190f12b4ac4f
mysql-devel-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: 5fb915a9c7b06d3ab0d63bb3fa332c3c2a4a8580a41584c0f375cd640579bc40
mysql-devel-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: 5fb915a9c7b06d3ab0d63bb3fa332c3c2a4a8580a41584c0f375cd640579bc40
mysql-server-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: dab1ebfeb366a93742f26a890223e89dda565a81d0cbe6adc39b86b2793fb429
mysql-server-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: dab1ebfeb366a93742f26a890223e89dda565a81d0cbe6adc39b86b2793fb429
i386
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-bench-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: 513d3d2a2609ff4e6bd3a5cf57a77620c4b0aa50a9024831269c96bff6a0d817
mysql-bench-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: 513d3d2a2609ff4e6bd3a5cf57a77620c4b0aa50a9024831269c96bff6a0d817
mysql-devel-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: b689775430bd4b890bebdfb905cd9ab5f996799e14ba718f08407495345d3cdb
mysql-devel-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: b689775430bd4b890bebdfb905cd9ab5f996799e14ba718f08407495345d3cdb
mysql-server-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef71499b369ebca8ddf5c2ffa0db2f4d6e7e0a1fac92e81d0a348b10de08e7d5
mysql-server-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef71499b369ebca8ddf5c2ffa0db2f4d6e7e0a1fac92e81d0a348b10de08e7d5

Red Hat Enterprise Linux Workstation 4

SRPM
mysql-4.1.12-3.RHEL4.1.src.rpm	SHA-256: 975eabf2b91a4edbf24067115658a495567a1f445d02b9ef101f8ff12109823a
x86_64
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: bd746a198acc0a546c46413b0ddc01e4b387172d8c9fd9825ad8d549760d26f9
mysql-bench-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: b0c563037ba75b46ab6792023ff612b310ce0a90cb0b88e5a26ad6760c7ef897
mysql-devel-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: 21b94cbece2b25c6f5cb2589359cd217acf6ca1610537a4460dfec49b380bdd6
mysql-server-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: 0fd7c7464a76f7de4665ea8c1ea30cd23173d8d4fbb89a401d78c6e8b158b9a5
ia64
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: 04a536fa47d9ab611c54a9b19f782e572c98b53511de57552176fd8c856892f5
mysql-bench-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: b48480555c097d689baec5b6e8961320683be9811490b156f08a190f12b4ac4f
mysql-devel-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: 5fb915a9c7b06d3ab0d63bb3fa332c3c2a4a8580a41584c0f375cd640579bc40
mysql-server-4.1.12-3.RHEL4.1.ia64.rpm	SHA-256: dab1ebfeb366a93742f26a890223e89dda565a81d0cbe6adc39b86b2793fb429
i386
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-bench-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: 513d3d2a2609ff4e6bd3a5cf57a77620c4b0aa50a9024831269c96bff6a0d817
mysql-devel-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: b689775430bd4b890bebdfb905cd9ab5f996799e14ba718f08407495345d3cdb
mysql-server-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef71499b369ebca8ddf5c2ffa0db2f4d6e7e0a1fac92e81d0a348b10de08e7d5

Red Hat Enterprise Linux Desktop 4

SRPM
mysql-4.1.12-3.RHEL4.1.src.rpm	SHA-256: 975eabf2b91a4edbf24067115658a495567a1f445d02b9ef101f8ff12109823a
x86_64
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: bd746a198acc0a546c46413b0ddc01e4b387172d8c9fd9825ad8d549760d26f9
mysql-bench-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: b0c563037ba75b46ab6792023ff612b310ce0a90cb0b88e5a26ad6760c7ef897
mysql-devel-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: 21b94cbece2b25c6f5cb2589359cd217acf6ca1610537a4460dfec49b380bdd6
mysql-server-4.1.12-3.RHEL4.1.x86_64.rpm	SHA-256: 0fd7c7464a76f7de4665ea8c1ea30cd23173d8d4fbb89a401d78c6e8b158b9a5
i386
mysql-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef40d5e2fff21c6a543c1a15a6b7892e323e080acb29c90e4c6fc1173cc8756c
mysql-bench-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: 513d3d2a2609ff4e6bd3a5cf57a77620c4b0aa50a9024831269c96bff6a0d817
mysql-devel-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: b689775430bd4b890bebdfb905cd9ab5f996799e14ba718f08407495345d3cdb
mysql-server-4.1.12-3.RHEL4.1.i386.rpm	SHA-256: ef71499b369ebca8ddf5c2ffa0db2f4d6e7e0a1fac92e81d0a348b10de08e7d5

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
mysql-4.1.12-3.RHEL4.1.src.rpm	SHA-256: 975eabf2b91a4edbf24067115658a495567a1f445d02b9ef101f8ff12109823a
s390x
mysql-4.1.12-3.RHEL4.1.s390.rpm	SHA-256: 67bc1db78d39483ac62f7df18e7d61c8f901ff3b0c4fe5bebf585a9dc983c8a2
mysql-4.1.12-3.RHEL4.1.s390x.rpm	SHA-256: 12bba400f31dcbb6872dc4c93ea8d7d7a8467cdd315e156cd755bd1e5249cfb5
mysql-bench-4.1.12-3.RHEL4.1.s390x.rpm	SHA-256: c21f651c79ae7e493f7b2cdae67a378cdd846406d6a0c840942e53912dbb8e9a
mysql-devel-4.1.12-3.RHEL4.1.s390x.rpm	SHA-256: 793f0a501f3311ff95d7dab502f724d6c64d32d6b22196ce3c97daf706a1ee33
mysql-server-4.1.12-3.RHEL4.1.s390x.rpm	SHA-256: b19e41f39f6263bd3014ce6269ce0234bb970670ebaa967bcad341dd4a516d37
s390
mysql-4.1.12-3.RHEL4.1.s390.rpm	SHA-256: 67bc1db78d39483ac62f7df18e7d61c8f901ff3b0c4fe5bebf585a9dc983c8a2
mysql-bench-4.1.12-3.RHEL4.1.s390.rpm	SHA-256: 2cc99fae26db7bb86e2fa907b9bac9d065e40987c775a79cb095db3018b51b00
mysql-devel-4.1.12-3.RHEL4.1.s390.rpm	SHA-256: 004ea4d6a456384b4937fc9d0b502eb81473f4575d7491c7ba9c02824d80d8a7
mysql-server-4.1.12-3.RHEL4.1.s390.rpm	SHA-256: 0a1b3c4fdb1bb3e072905b5dfef348aee8cbe20d5f5b3f8e11be912db6d7ed99

Red Hat Enterprise Linux for Power, big endian 4

SRPM
mysql-4.1.12-3.RHEL4.1.src.rpm	SHA-256: 975eabf2b91a4edbf24067115658a495567a1f445d02b9ef101f8ff12109823a
ppc
mysql-4.1.12-3.RHEL4.1.ppc.rpm	SHA-256: 788a67c018032850f48e99deb3c9d7fcb58d93b0d4ed041a628062b8853e7b9e
mysql-4.1.12-3.RHEL4.1.ppc64.rpm	SHA-256: 28e3bd72d6d7bfef492c0fddcb65b37f85208009f29c82acf89980589d3632e6
mysql-bench-4.1.12-3.RHEL4.1.ppc.rpm	SHA-256: b038b40901d51ad1f9212c0d9332d0b71d99a634dc72672713bf1cc82e5349c9
mysql-devel-4.1.12-3.RHEL4.1.ppc.rpm	SHA-256: 2dedd2f5af757699f101f928d4d73974f5ed3291fac488e21fa26d1f58958684
mysql-server-4.1.12-3.RHEL4.1.ppc.rpm	SHA-256: a08414e1439561662ab74e22475fbecca8ae9396bcbea4644f5aee49f0223b51