Synopsis

Important: mysql security update

Type/Severity

Security Advisory: Important

Topic

Updated mysql packages that fix a security flaw are now available for Red
Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat
Security Response Team.

Description

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a
client/server implementation consisting of a server daemon (mysqld) and
many different client programs and libraries.

A flaw was discovered in MySQL's authentication protocol. It is possible
for a remote unauthenticated attacker to send a specially crafted
authentication request to the MySQL server causing it to crash. (CVE-2007-3780)

All users of the MySQL server are advised to upgrade to these updated
packages, which contain a backported patch which fixes this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 254108 - CVE-2007-3780 mysql malformed password crasher

CVEs

• CVE-2007-3780

References

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
mysql-4.1.20-2.RHEL4.1.0.1.ppc.rpm	SHA-256: b59ade7ca4e69ca74901db1e244f5b5e044ad14b9c95027e9d35ef677a65d96c
mysql-4.1.20-2.RHEL4.1.0.1.ppc64.rpm	SHA-256: 2ce6819ed59a89dc8d573ec0339b604963cd1b1c620488171f5385fdb64938fa
mysql-bench-4.1.20-2.RHEL4.1.0.1.ppc.rpm	SHA-256: 8c04fbd3373b4d5716bdbb55f108b26104ed7dbb5382ef4524139db49d511712
mysql-devel-4.1.20-2.RHEL4.1.0.1.ppc.rpm	SHA-256: 402740cf5f9953b39c12d0603e40572330d9c400935014f19538b1f7d9751d5a
mysql-server-4.1.20-2.RHEL4.1.0.1.ppc.rpm	SHA-256: 28041a0579b2166d89124636816eea31c154e6ed9f0e8365b4c71e2525954373

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5

SRPM
ppc
mysql-4.1.20-2.RHEL4.1.0.1.ppc.rpm	SHA-256: b59ade7ca4e69ca74901db1e244f5b5e044ad14b9c95027e9d35ef677a65d96c
mysql-4.1.20-2.RHEL4.1.0.1.ppc64.rpm	SHA-256: 2ce6819ed59a89dc8d573ec0339b604963cd1b1c620488171f5385fdb64938fa
mysql-bench-4.1.20-2.RHEL4.1.0.1.ppc.rpm	SHA-256: 8c04fbd3373b4d5716bdbb55f108b26104ed7dbb5382ef4524139db49d511712
mysql-devel-4.1.20-2.RHEL4.1.0.1.ppc.rpm	SHA-256: 402740cf5f9953b39c12d0603e40572330d9c400935014f19538b1f7d9751d5a
mysql-server-4.1.20-2.RHEL4.1.0.1.ppc.rpm	SHA-256: 28041a0579b2166d89124636816eea31c154e6ed9f0e8365b4c71e2525954373