Synopsis

Moderate: mysql security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

Updated mysql packages that fix various security issues, several bugs, and
add an enhancement are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a
client/server implementation consisting of a server daemon (mysqld), and
many different client programs and libraries.

MySQL did not correctly check directories used as arguments for the DATA
DIRECTORY and INDEX DIRECTORY directives. Using this flaw, an authenticated
attacker could elevate their access privileges to tables created by other
database users. Note: this attack does not work on existing tables. An
attacker can only elevate their access to another user's tables as the
tables are created. As well, the names of these created tables need to be
predicted correctly for this attack to succeed. (CVE-2008-2079)

MySQL did not require the "DROP" privilege for "RENAME TABLE" statements.
An authenticated user could use this flaw to rename arbitrary tables.
(CVE-2007-2691)

MySQL allowed an authenticated user to access a table through a previously
created MERGE table, even after the user's privileges were revoked from the
original table, which might violate intended security policy. This is
addressed by allowing the MERGE storage engine to be disabled, which can be
done by running mysqld with the "--skip-merge" option. (CVE-2006-4031)

A flaw in MySQL allowed an authenticated user to cause the MySQL daemon to
crash via crafted SQL queries. This only caused a temporary denial of
service, as the MySQL daemon is automatically restarted after the crash.
(CVE-2006-3469)

As well, these updated packages fix the following bugs:

• in the previous mysql packages, if a column name was referenced more
  than once in an "ORDER BY" section of a query, a segmentation fault
  occurred.
  
• when MySQL failed to start, the init script returned a successful (0)
  exit code. When using the Red Hat Cluster Suite, this may have caused
  cluster services to report a successful start, even when MySQL failed to
  start. In these updated packages, the init script returns the correct exit
  codes, which resolves this issue.
  
• it was possible to use the mysqld_safe command to specify invalid port
  numbers (higher than 65536), causing invalid ports to be created, and, in
  some cases, a "port number definition: unsigned short" error. In these
  updated packages, when an invalid port number is specified, the default
  port number is used.
  
• when setting "myisam_repair_threads > 1", any repair set the index
  cardinality to "1", regardless of the table size.
  
• the MySQL init script no longer runs "chmod -R" on the entire database
  directory tree during every startup.
  
• when running "mysqldump" with the MySQL 4.0 compatibility mode option,
  "--compatible=mysql40", mysqldump created dumps that omitted the
  "auto_increment" field.
  

As well, the MySQL init script now uses more reliable methods for
determining parameters, such as the data directory location.

Note: these updated packages upgrade MySQL to version 4.1.22. For a full
list of bug fixes and enhancements, refer to the MySQL release notes:
http://dev.mysql.com/doc/refman/4.1/en/news-4-1-22.html

All mysql users are advised to upgrade to these updated packages, which
resolve these issues and add this enhancement.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 201904 - CVE-2006-3469 mysql server DoS
• BZ - 201988 - Queries using a column name multiple times in ORDER BY crash mysql
• BZ - 202246 - CVE-2006-4031 MySQL improper permission revocation
• BZ - 221085 - chown -R of the mysql data directory every startup
• BZ - 233771 - RFE+patch: MySQLd "init.d" startup script should rely on "/usr/bin/my_print_defaults" to get at options
• BZ - 241688 - CVE-2007-2691 mysql DROP privilege not enforced when renaming tables
• BZ - 445222 - CVE-2008-2079 mysql: privilege escalation via DATA/INDEX DIRECTORY directives

CVEs

• CVE-2006-4031
• CVE-2007-2691
• CVE-2008-2079
• CVE-2006-3469

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 4

SRPM
mysql-4.1.22-2.el4.src.rpm	SHA-256: b2ed7283879bb2bbf56b89b85b1a06b396c36be316e89ee910de8c26e5ba02a0
x86_64
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-4.1.22-2.el4.x86_64.rpm	SHA-256: 9031850be0b1dda809d018a056a9f71724825c73986b0aeac4831861ff127036
mysql-4.1.22-2.el4.x86_64.rpm	SHA-256: 9031850be0b1dda809d018a056a9f71724825c73986b0aeac4831861ff127036
mysql-bench-4.1.22-2.el4.x86_64.rpm	SHA-256: 67299148a624eb0f3b953f63d60cb762e69b3b21b16364ab239633cc309d5556
mysql-bench-4.1.22-2.el4.x86_64.rpm	SHA-256: 67299148a624eb0f3b953f63d60cb762e69b3b21b16364ab239633cc309d5556
mysql-devel-4.1.22-2.el4.x86_64.rpm	SHA-256: 0fc5c9a7285d3ed7b93bb276fd3e09c5a1e205bf2de86ee19234f3e26a8cf784
mysql-devel-4.1.22-2.el4.x86_64.rpm	SHA-256: 0fc5c9a7285d3ed7b93bb276fd3e09c5a1e205bf2de86ee19234f3e26a8cf784
mysql-server-4.1.22-2.el4.x86_64.rpm	SHA-256: 065a950a73ef33a61c5ee249d5bb8f1b3793a9499a7b9d751819a8f79ee3a700
mysql-server-4.1.22-2.el4.x86_64.rpm	SHA-256: 065a950a73ef33a61c5ee249d5bb8f1b3793a9499a7b9d751819a8f79ee3a700
ia64
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-4.1.22-2.el4.ia64.rpm	SHA-256: 4dd920f4d6fbe5b8c1a7425a23931db1d766621a79aec65c7a0c210d867bacdc
mysql-4.1.22-2.el4.ia64.rpm	SHA-256: 4dd920f4d6fbe5b8c1a7425a23931db1d766621a79aec65c7a0c210d867bacdc
mysql-bench-4.1.22-2.el4.ia64.rpm	SHA-256: 64270e703eb666718aaf9bc11d62e0a96c8d2b0627a6efc37200a9e79bae24b4
mysql-bench-4.1.22-2.el4.ia64.rpm	SHA-256: 64270e703eb666718aaf9bc11d62e0a96c8d2b0627a6efc37200a9e79bae24b4
mysql-devel-4.1.22-2.el4.ia64.rpm	SHA-256: 9b3dc4bec9e69a32bc3b13eaccb072e6fd2fe5f60778bcdc70d7c45cb803f1ec
mysql-devel-4.1.22-2.el4.ia64.rpm	SHA-256: 9b3dc4bec9e69a32bc3b13eaccb072e6fd2fe5f60778bcdc70d7c45cb803f1ec
mysql-server-4.1.22-2.el4.ia64.rpm	SHA-256: df9eb7f334b444e29cde739f03565937b2a968ae8953552b88cf11a83f71d53f
mysql-server-4.1.22-2.el4.ia64.rpm	SHA-256: df9eb7f334b444e29cde739f03565937b2a968ae8953552b88cf11a83f71d53f
i386
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-bench-4.1.22-2.el4.i386.rpm	SHA-256: 7d54b5da352d2eec8140a9bdaba9b32aed3ade34b6df0d7ae1baf4dcf7e4ba95
mysql-bench-4.1.22-2.el4.i386.rpm	SHA-256: 7d54b5da352d2eec8140a9bdaba9b32aed3ade34b6df0d7ae1baf4dcf7e4ba95
mysql-devel-4.1.22-2.el4.i386.rpm	SHA-256: 6136865a65520d29c6da6edb3c8e93254233d76703630a72c91733b6d8cc8e9c
mysql-devel-4.1.22-2.el4.i386.rpm	SHA-256: 6136865a65520d29c6da6edb3c8e93254233d76703630a72c91733b6d8cc8e9c
mysql-server-4.1.22-2.el4.i386.rpm	SHA-256: 600cb105f5dfb58faf8f2cbbeaacea4d5e071cf2b355e6a2da9c81256e46630a
mysql-server-4.1.22-2.el4.i386.rpm	SHA-256: 600cb105f5dfb58faf8f2cbbeaacea4d5e071cf2b355e6a2da9c81256e46630a

Red Hat Enterprise Linux Workstation 4

SRPM
mysql-4.1.22-2.el4.src.rpm	SHA-256: b2ed7283879bb2bbf56b89b85b1a06b396c36be316e89ee910de8c26e5ba02a0
x86_64
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-4.1.22-2.el4.x86_64.rpm	SHA-256: 9031850be0b1dda809d018a056a9f71724825c73986b0aeac4831861ff127036
mysql-bench-4.1.22-2.el4.x86_64.rpm	SHA-256: 67299148a624eb0f3b953f63d60cb762e69b3b21b16364ab239633cc309d5556
mysql-devel-4.1.22-2.el4.x86_64.rpm	SHA-256: 0fc5c9a7285d3ed7b93bb276fd3e09c5a1e205bf2de86ee19234f3e26a8cf784
mysql-server-4.1.22-2.el4.x86_64.rpm	SHA-256: 065a950a73ef33a61c5ee249d5bb8f1b3793a9499a7b9d751819a8f79ee3a700
ia64
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-4.1.22-2.el4.ia64.rpm	SHA-256: 4dd920f4d6fbe5b8c1a7425a23931db1d766621a79aec65c7a0c210d867bacdc
mysql-bench-4.1.22-2.el4.ia64.rpm	SHA-256: 64270e703eb666718aaf9bc11d62e0a96c8d2b0627a6efc37200a9e79bae24b4
mysql-devel-4.1.22-2.el4.ia64.rpm	SHA-256: 9b3dc4bec9e69a32bc3b13eaccb072e6fd2fe5f60778bcdc70d7c45cb803f1ec
mysql-server-4.1.22-2.el4.ia64.rpm	SHA-256: df9eb7f334b444e29cde739f03565937b2a968ae8953552b88cf11a83f71d53f
i386
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-bench-4.1.22-2.el4.i386.rpm	SHA-256: 7d54b5da352d2eec8140a9bdaba9b32aed3ade34b6df0d7ae1baf4dcf7e4ba95
mysql-devel-4.1.22-2.el4.i386.rpm	SHA-256: 6136865a65520d29c6da6edb3c8e93254233d76703630a72c91733b6d8cc8e9c
mysql-server-4.1.22-2.el4.i386.rpm	SHA-256: 600cb105f5dfb58faf8f2cbbeaacea4d5e071cf2b355e6a2da9c81256e46630a

Red Hat Enterprise Linux Desktop 4

SRPM
mysql-4.1.22-2.el4.src.rpm	SHA-256: b2ed7283879bb2bbf56b89b85b1a06b396c36be316e89ee910de8c26e5ba02a0
x86_64
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-4.1.22-2.el4.x86_64.rpm	SHA-256: 9031850be0b1dda809d018a056a9f71724825c73986b0aeac4831861ff127036
mysql-bench-4.1.22-2.el4.x86_64.rpm	SHA-256: 67299148a624eb0f3b953f63d60cb762e69b3b21b16364ab239633cc309d5556
mysql-devel-4.1.22-2.el4.x86_64.rpm	SHA-256: 0fc5c9a7285d3ed7b93bb276fd3e09c5a1e205bf2de86ee19234f3e26a8cf784
mysql-server-4.1.22-2.el4.x86_64.rpm	SHA-256: 065a950a73ef33a61c5ee249d5bb8f1b3793a9499a7b9d751819a8f79ee3a700
i386
mysql-4.1.22-2.el4.i386.rpm	SHA-256: 305c8d0ef8ee2ac7e2a76ae1df399fa3ad7ebeea0cbffcb1167512b81f7216d4
mysql-bench-4.1.22-2.el4.i386.rpm	SHA-256: 7d54b5da352d2eec8140a9bdaba9b32aed3ade34b6df0d7ae1baf4dcf7e4ba95
mysql-devel-4.1.22-2.el4.i386.rpm	SHA-256: 6136865a65520d29c6da6edb3c8e93254233d76703630a72c91733b6d8cc8e9c
mysql-server-4.1.22-2.el4.i386.rpm	SHA-256: 600cb105f5dfb58faf8f2cbbeaacea4d5e071cf2b355e6a2da9c81256e46630a

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
mysql-4.1.22-2.el4.src.rpm	SHA-256: b2ed7283879bb2bbf56b89b85b1a06b396c36be316e89ee910de8c26e5ba02a0
s390x
mysql-4.1.22-2.el4.s390.rpm	SHA-256: fb1c27d47c2e36d965a3164eee5dbd0615cd7da559b951acd204d0c554764634
mysql-4.1.22-2.el4.s390x.rpm	SHA-256: c2a6beac04995bfeb269b8cef7e8aefb1dde6b461488fc1409881cf7e09fe7d1
mysql-bench-4.1.22-2.el4.s390x.rpm	SHA-256: 2599bf4a05f80ac849384e84e2c33ee61701db9e87ce74149674e6a1a532aaf8
mysql-devel-4.1.22-2.el4.s390x.rpm	SHA-256: 72ce7489240ed6b8ac4077d4d0833fbc29a7d69729e94dc972309e61cd3a7d5b
mysql-server-4.1.22-2.el4.s390x.rpm	SHA-256: a8e17210bc86d19921371b0587f49e7e3f83afdc1b2abfe54db60335963c9c3f
s390
mysql-4.1.22-2.el4.s390.rpm	SHA-256: fb1c27d47c2e36d965a3164eee5dbd0615cd7da559b951acd204d0c554764634
mysql-bench-4.1.22-2.el4.s390.rpm	SHA-256: 7049ba7ef8cab2b6bf3f3c83b36a4bffd452d2ebf8e8c7b4831990019ff21f45
mysql-devel-4.1.22-2.el4.s390.rpm	SHA-256: 5b7b5a5ae6b96ef2efbf7f5b4feb684be27f08f24579edddf190da5076cbea4a
mysql-server-4.1.22-2.el4.s390.rpm	SHA-256: a950ce6dbe5ef8a69d70d282694565169bef0e3a92e92c7575178d4d5f050881

Red Hat Enterprise Linux for Power, big endian 4

SRPM
mysql-4.1.22-2.el4.src.rpm	SHA-256: b2ed7283879bb2bbf56b89b85b1a06b396c36be316e89ee910de8c26e5ba02a0
ppc
mysql-4.1.22-2.el4.ppc.rpm	SHA-256: 3d746fe29f22d9003c4d616a00eead7d3da1d60d341defb99bf90be2cb9f6dda
mysql-4.1.22-2.el4.ppc64.rpm	SHA-256: 9e36e6ce0b6b83616617c2c0a0ddd70cc22c33ccf5107553fbfe703dad4c25de
mysql-bench-4.1.22-2.el4.ppc.rpm	SHA-256: a91769db9b1be4535353b8f59d859559c81ebdf155dfc37da4d24c843f2d9640
mysql-devel-4.1.22-2.el4.ppc.rpm	SHA-256: 162968863c843265de8c42424b15c64b382876b826d27775a24ac6f3c384b8fd
mysql-server-4.1.22-2.el4.ppc.rpm	SHA-256: 1028447c8fa2ba9913ab7b2b60a823b998989f3dc3bf35534bba22b0dd21fb66