Synopsis

Low: mysql security and bug fix update

Type/Severity

Security Advisory: Low

Topic

Updated mysql packages that fix one security issue and several bugs are now
available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

It was found that the fix for the CVE-2009-4030 issue, a flaw in the way
MySQL checked the paths used as arguments for the DATA DIRECTORY and INDEX
DIRECTORY directives when the "datadir" option was configured with a
relative path, was incorrectly removed when the mysql packages in Red Hat
Enterprise Linux 5 were updated to version 5.0.95 via RHSA-2012:0127. An
authenticated attacker could use this flaw to bypass the restriction
preventing the use of subdirectories of the MySQL data directory being used
as DATA DIRECTORY and INDEX DIRECTORY paths. This update re-applies the fix
for CVE-2009-4030. (CVE-2012-4452)

Note: If the use of the DATA DIRECTORY and INDEX DIRECTORY directives were
disabled as described in RHSA-2010:0109 (by adding "symbolic-links=0" to
the "[mysqld]" section of the "my.cnf" configuration file), users were not
vulnerable to this issue.

This issue was discovered by Karel Volny of the Red Hat Quality Engineering
team.

This update also fixes the following bugs:

• Prior to this update, the log file path in the logrotate script did not
  behave as expected. As a consequence, the logrotate function failed to
  rotate the "/var/log/mysqld.log" file. This update modifies the logrotate
  script to allow rotating the mysqld.log file. (BZ#647223)
  
• Prior to this update, the mysqld daemon could fail when using the EXPLAIN
  flag in prepared statement mode. This update modifies the underlying code
  to handle the EXPLAIN flag as expected. (BZ#654000)
  
• Prior to this update, the mysqld init script could wrongly report that
  mysql server startup failed when the server was actually started. This
  update modifies the init script to report the status of the mysqld server
  as expected. (BZ#703476)
  
• Prior to this update, the "--enable-profiling" option was by default
  disabled. This update enables the profiling feature. (BZ#806365)
  

All MySQL users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. After installing this
update, the MySQL server daemon (mysqld) will be restarted automatically.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 526850 - MySQL 5.0.77 crashes on comparison of date & datetime types to NAME_CONST()
• BZ - 528512 - MySQL memory DoS
• BZ - 543730 - mysqld segfaults during SHOW CREATE TABLE
• BZ - 548685 - Extra characters appear in BLOB after mysqldump/import
• BZ - 654000 - Mysql bug 54488 - crash when using explain and prepared statements with subqueries
• BZ - 675906 - Restore / import of mysqldump fails on "Unknown command '\''"
• BZ - 806365 - mysql-server-5.0.95-1.el5_7.1 has Profiling disabled by default
• BZ - 860808 - CVE-2012-4452 mysql: regression of CVE-2009-4030

CVEs

• CVE-2012-4452

References

• https://access.redhat.com/security/updates/classification/#low
• https://rhn.redhat.com/errata/RHSA-2012-0127.html
• https://rhn.redhat.com/errata/RHSA-2010-0109.html

Red Hat Enterprise Linux Server 5

SRPM
mysql-5.0.95-3.el5.src.rpm	SHA-256: 31450ba2ad54d48ba895a563af02e9a5382faefbc5e0c1223ef47b084a0352d0
x86_64
mysql-5.0.95-3.el5.i386.rpm	SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-5.0.95-3.el5.x86_64.rpm	SHA-256: 8ff75d3f460a365e536a34fdca97f99cd80adb98ae396a0d3dce00508e455f0f
mysql-bench-5.0.95-3.el5.x86_64.rpm	SHA-256: 7cfa7a53018ec90023f60ec48ca78e955986c30d227282dd4310e9df0a3e1820
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.x86_64.rpm	SHA-256: 6d77fb84711d1c2be366a930eb2161319f2694013e884dd1ed5f21fb43d4f375
mysql-devel-5.0.95-3.el5.i386.rpm	SHA-256: 65ad5e18635d02550c791118775a55431a8ec01d0734db4fb9e003dcde77c5a1
mysql-devel-5.0.95-3.el5.x86_64.rpm	SHA-256: 3262f889dc0afbe0984aab1b6c5a6505cee1ba97870c929ef7fe6fe7f399b1c8
mysql-server-5.0.95-3.el5.x86_64.rpm	SHA-256: 3cf7e23d70d8b1645309d6637f3e84a2f0ffb665a2cb5cb77e258bb9829071ad
mysql-test-5.0.95-3.el5.x86_64.rpm	SHA-256: 8eda50bb7758aadafa16014736df13a726e7f2f91a89249caa2d8595fda3d0f9
ia64
mysql-5.0.95-3.el5.i386.rpm	SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-5.0.95-3.el5.ia64.rpm	SHA-256: 7667d91c4a84d4650af03802dfb5faaadc01e1bacd10c766975bfdd5204e7fb9
mysql-bench-5.0.95-3.el5.ia64.rpm	SHA-256: f46360d90824a6f0ea308f42ecb1eb0b29c75311648c492f311412ef1de5af8a
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.ia64.rpm	SHA-256: 6f16263c831f0c62ade4c438a6b996c5868542b1bae5908c71f431a330b0104f
mysql-devel-5.0.95-3.el5.ia64.rpm	SHA-256: df73406706451b035be3a2ca4df872d8037648f8ababdadbec79237623860547
mysql-server-5.0.95-3.el5.ia64.rpm	SHA-256: 669e2cf7044c685ecb6bdbb19b690010607ac1133ecf0333aa9805f15d0dcf11
mysql-test-5.0.95-3.el5.ia64.rpm	SHA-256: 5dd567d6b9162077ea34083bd810b6ed30d5cd686cbf33229c807494624e1495
i386
mysql-5.0.95-3.el5.i386.rpm	SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-bench-5.0.95-3.el5.i386.rpm	SHA-256: e85064fad4d23ea5c594d31d5f7b0187d5c9a1da7fbc5abe31795b498ecfc365
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-devel-5.0.95-3.el5.i386.rpm	SHA-256: 65ad5e18635d02550c791118775a55431a8ec01d0734db4fb9e003dcde77c5a1
mysql-server-5.0.95-3.el5.i386.rpm	SHA-256: 40a7b2d2c8cfc328040b30debd6d3b3cbd2a62aa4f431a605b954bfe7e84e8ac
mysql-test-5.0.95-3.el5.i386.rpm	SHA-256: e2f050049849740a878474b8e0c17a9a27a5d981cf6a658595330d5bb0afaf21

Red Hat Enterprise Linux Workstation 5

SRPM
mysql-5.0.95-3.el5.src.rpm	SHA-256: 31450ba2ad54d48ba895a563af02e9a5382faefbc5e0c1223ef47b084a0352d0
x86_64
mysql-5.0.95-3.el5.i386.rpm	SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-5.0.95-3.el5.x86_64.rpm	SHA-256: 8ff75d3f460a365e536a34fdca97f99cd80adb98ae396a0d3dce00508e455f0f
mysql-bench-5.0.95-3.el5.x86_64.rpm	SHA-256: 7cfa7a53018ec90023f60ec48ca78e955986c30d227282dd4310e9df0a3e1820
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.x86_64.rpm	SHA-256: 6d77fb84711d1c2be366a930eb2161319f2694013e884dd1ed5f21fb43d4f375
mysql-debuginfo-5.0.95-3.el5.x86_64.rpm	SHA-256: 6d77fb84711d1c2be366a930eb2161319f2694013e884dd1ed5f21fb43d4f375
mysql-devel-5.0.95-3.el5.i386.rpm	SHA-256: 65ad5e18635d02550c791118775a55431a8ec01d0734db4fb9e003dcde77c5a1
mysql-devel-5.0.95-3.el5.x86_64.rpm	SHA-256: 3262f889dc0afbe0984aab1b6c5a6505cee1ba97870c929ef7fe6fe7f399b1c8
mysql-server-5.0.95-3.el5.x86_64.rpm	SHA-256: 3cf7e23d70d8b1645309d6637f3e84a2f0ffb665a2cb5cb77e258bb9829071ad
mysql-test-5.0.95-3.el5.x86_64.rpm	SHA-256: 8eda50bb7758aadafa16014736df13a726e7f2f91a89249caa2d8595fda3d0f9
i386
mysql-5.0.95-3.el5.i386.rpm	SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-bench-5.0.95-3.el5.i386.rpm	SHA-256: e85064fad4d23ea5c594d31d5f7b0187d5c9a1da7fbc5abe31795b498ecfc365
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-devel-5.0.95-3.el5.i386.rpm	SHA-256: 65ad5e18635d02550c791118775a55431a8ec01d0734db4fb9e003dcde77c5a1
mysql-server-5.0.95-3.el5.i386.rpm	SHA-256: 40a7b2d2c8cfc328040b30debd6d3b3cbd2a62aa4f431a605b954bfe7e84e8ac
mysql-test-5.0.95-3.el5.i386.rpm	SHA-256: e2f050049849740a878474b8e0c17a9a27a5d981cf6a658595330d5bb0afaf21

Red Hat Enterprise Linux Desktop 5

SRPM
mysql-5.0.95-3.el5.src.rpm	SHA-256: 31450ba2ad54d48ba895a563af02e9a5382faefbc5e0c1223ef47b084a0352d0
x86_64
mysql-5.0.95-3.el5.i386.rpm	SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-5.0.95-3.el5.x86_64.rpm	SHA-256: 8ff75d3f460a365e536a34fdca97f99cd80adb98ae396a0d3dce00508e455f0f
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.x86_64.rpm	SHA-256: 6d77fb84711d1c2be366a930eb2161319f2694013e884dd1ed5f21fb43d4f375
i386
mysql-5.0.95-3.el5.i386.rpm	SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
mysql-5.0.95-3.el5.src.rpm	SHA-256: 31450ba2ad54d48ba895a563af02e9a5382faefbc5e0c1223ef47b084a0352d0
s390x
mysql-5.0.95-3.el5.s390.rpm	SHA-256: 98d952412055eeed4f483c8abe7667cc84de08748a7d770661babbf945194796
mysql-5.0.95-3.el5.s390x.rpm	SHA-256: 28b2bcf659f9106b0d3f823e548206b2629b618f5ea0dfd3c1b24762ea808d32
mysql-bench-5.0.95-3.el5.s390x.rpm	SHA-256: fe4f506a72d2e18cbc2fe6d3cd5c1c55a1d1ba7e83d939013c7421e132b7fb35
mysql-debuginfo-5.0.95-3.el5.s390.rpm	SHA-256: 7055e97bb3779dfe2624f8fd4ab717b617c336dbd7d2727a43e5c22848a495ea
mysql-debuginfo-5.0.95-3.el5.s390x.rpm	SHA-256: f6438b866852dc6f6239b5fc2f08303b26a28f3100b25a41b0a80f0fdc60a44c
mysql-devel-5.0.95-3.el5.s390.rpm	SHA-256: fd5b9a67bb8d7c3d44f939211b741334936d38bf78e00a30d427e4d04e11aaff
mysql-devel-5.0.95-3.el5.s390x.rpm	SHA-256: 6c5056b2f0e48add20c39517ea72c779e812579e05ec6d2bcc3525d720540b31
mysql-server-5.0.95-3.el5.s390x.rpm	SHA-256: a70f033ba63f8d60280d570f18e6ad82cd2d81444f3347177fa1d04152a6e433
mysql-test-5.0.95-3.el5.s390x.rpm	SHA-256: 854780ee2c3d248d6cf7ea1806395c641704261c89762381c214eeeb4965c3ef

Red Hat Enterprise Linux for Power, big endian 5

SRPM
mysql-5.0.95-3.el5.src.rpm	SHA-256: 31450ba2ad54d48ba895a563af02e9a5382faefbc5e0c1223ef47b084a0352d0
ppc
mysql-5.0.95-3.el5.ppc.rpm	SHA-256: 5721982ac5790c1239363f8487875d08a2da6e2ab572337a92e06c630b69e122
mysql-5.0.95-3.el5.ppc64.rpm	SHA-256: 583ccd69b2fab8106ef77f74ee0ac7005203efb8b9305d3ccee2a1eacb8f7a93
mysql-bench-5.0.95-3.el5.ppc.rpm	SHA-256: e1abb01d4eea0f37062535707e73837302030fa4412b61e80bf5fc8aecc9f83a
mysql-debuginfo-5.0.95-3.el5.ppc.rpm	SHA-256: 7bc63aa34e479c48411e7d85fa5211c324fac9cd3bd40dd20355b808a048089f
mysql-debuginfo-5.0.95-3.el5.ppc64.rpm	SHA-256: e5bb101df0bcb9fdfc7dd1a1581ca2122d9610d1646f85c53839c2fc23fc92fc
mysql-devel-5.0.95-3.el5.ppc.rpm	SHA-256: 6a50e58de8e22929521cafd251b847619f846b6f321af97875696933144f3f09
mysql-devel-5.0.95-3.el5.ppc64.rpm	SHA-256: 2f56d25ed03f2038fe4b0e5b7cb0bff1bc618c0196e816407c7d2d0703968d09
mysql-server-5.0.95-3.el5.ppc.rpm	SHA-256: eb3e085e7ebfeb3c7f945d70ec1fde88905bf74bf502ca251aca4c66675c91bb
mysql-server-5.0.95-3.el5.ppc64.rpm	SHA-256: b1c67b52e3fdabbad25afb8c6b4f3f347adf1be7e8e8d0b46bd1b091382c9eca
mysql-test-5.0.95-3.el5.ppc.rpm	SHA-256: 0092ae04d65a3c084af9c1dc4e3792f9f78447c6aa1b431606aa272aa466cdb9

Red Hat Enterprise Linux Server from RHUI 5

SRPM
mysql-5.0.95-3.el5.src.rpm	SHA-256: 31450ba2ad54d48ba895a563af02e9a5382faefbc5e0c1223ef47b084a0352d0
x86_64
mysql-5.0.95-3.el5.i386.rpm	SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-5.0.95-3.el5.x86_64.rpm	SHA-256: 8ff75d3f460a365e536a34fdca97f99cd80adb98ae396a0d3dce00508e455f0f
mysql-bench-5.0.95-3.el5.x86_64.rpm	SHA-256: 7cfa7a53018ec90023f60ec48ca78e955986c30d227282dd4310e9df0a3e1820
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-debuginfo-5.0.95-3.el5.x86_64.rpm	SHA-256: 6d77fb84711d1c2be366a930eb2161319f2694013e884dd1ed5f21fb43d4f375
mysql-devel-5.0.95-3.el5.i386.rpm	SHA-256: 65ad5e18635d02550c791118775a55431a8ec01d0734db4fb9e003dcde77c5a1
mysql-devel-5.0.95-3.el5.x86_64.rpm	SHA-256: 3262f889dc0afbe0984aab1b6c5a6505cee1ba97870c929ef7fe6fe7f399b1c8
mysql-server-5.0.95-3.el5.x86_64.rpm	SHA-256: 3cf7e23d70d8b1645309d6637f3e84a2f0ffb665a2cb5cb77e258bb9829071ad
mysql-test-5.0.95-3.el5.x86_64.rpm	SHA-256: 8eda50bb7758aadafa16014736df13a726e7f2f91a89249caa2d8595fda3d0f9
i386
mysql-5.0.95-3.el5.i386.rpm	SHA-256: f3e7350581cdfeaa6fb202e2c5636cb21ee26c01e8887cd6f0647d5bc55638b6
mysql-bench-5.0.95-3.el5.i386.rpm	SHA-256: e85064fad4d23ea5c594d31d5f7b0187d5c9a1da7fbc5abe31795b498ecfc365
mysql-debuginfo-5.0.95-3.el5.i386.rpm	SHA-256: 6650ea0e3ef15bba031bcd2040bfa0baef388c5931149ae9da8a46f4b4e385c2
mysql-devel-5.0.95-3.el5.i386.rpm	SHA-256: 65ad5e18635d02550c791118775a55431a8ec01d0734db4fb9e003dcde77c5a1
mysql-server-5.0.95-3.el5.i386.rpm	SHA-256: 40a7b2d2c8cfc328040b30debd6d3b3cbd2a62aa4f431a605b954bfe7e84e8ac
mysql-test-5.0.95-3.el5.i386.rpm	SHA-256: e2f050049849740a878474b8e0c17a9a27a5d981cf6a658595330d5bb0afaf21