Debians sikkerhedsbulletin

DSA-212-1 mysql -- flere problemer

Rapporteret den:
17. dec 2002
Berørte pakker:
mysql
Sårbar:
Ja
Referencer i sikkerhedsdatabaser:
I Bugtraq-databasen (hos SecurityFocus): BugTraq-id 6373, BugTraq-id 6368, BugTraq-id 6375.
I Mitres CVE-ordbog: CVE-2002-1373, CVE-2002-1374, CVE-2002-1375, CVE-2002-1376.
Yderligere oplysninger:

Ved en gennemgang af MySQL fandt e-matters flere problemer:

fortegnsproblem i COM_TABLE_DUMP
To størrelser blev betragtet som heltalsværdier med fortegn fra en forespørgsel og dernæst typekonverteret til et heltal uden fortegn, uden at kontrollere for negative tal. Da det resulterende tal blev brugt i en memcpy()-handling, kunne det føre til ødelæggelse af hukommelsen.
Håndtering af adgangskodelængde i COM_CHANGE_USER
Ved genautentifikation til en anden bruger, udførte MySQL ikke alle kontroller som udføres ved den indledende autentifikation. Dette medførte to problemer:
  • det var muligt ved hjælp af "brute force"-metoden, et tegn ad gangen at finde frem til adgangskoden (det rettede vi ved den indledende login i februar 2000), hvilket kunne anvendes af en normal bruger til at opnå root-rettigheder til databasen
  • det var muligt at få adgangskodebufferen til at løbe over og tvinge serveren til at udføre vilkårlig kode.
read_rows()-overløb i libmysqlclient
Ved behandling af rækker returneret af en SQL-server, var der ingen kontrol af unormalt store rækker eller afsluttende NUL-tegn. Dette kunne anvendes til at udnytte SQL-klienter, hvis de forbandt sig til udnyttede MySQL-server.
read_one_row()-overløb i libmysqlclient
Ved behandling af en række returneret af en SQL-server, blev de returnerede feltstørrelser ikke kontrolleret. Dette kunne anvendes til at udnytte SQL-klienter, hvis de forbandt sig til den udnyttede MySQL-server.

I Debian GNU/Linux 3.0/woody er dette rettet i version 3.23.49-8.2 og version 3.22.32-6.3 i Debian GNU/Linux 2.2/potato.

Vi anbefaler at du opgraderer dine mysql-pakker så hurtigt som muligt.

Rettet i:

Debian GNU/Linux 2.2 (oldstable)

Kildekode:
http://security.debian.org/pool/updates/main/m/mysql/mysql_3.22.32-6.3.dsc
http://security.debian.org/pool/updates/main/m/mysql/mysql_3.22.32.orig.tar.gz
http://security.debian.org/pool/updates/main/m/mysql/mysql_3.22.32-6.3.diff.gz
Arkitekturuafhængig komponent:
http://security.debian.org/pool/updates/main/m/mysql/mysql-doc_3.22.32-6.3_all.deb
alpha (DEC Alpha):
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_alpha.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_alpha.deb
arm (ARM):
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_arm.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_arm.deb
i386 (Intel ia32):
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_i386.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_i386.deb
m68k (Motorola Mc680x0):
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_m68k.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_m68k.deb
powerpc (PowerPC):
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_powerpc.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_powerpc.deb
sparc (Sun SPARC/UltraSPARC):
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_sparc.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_sparc.deb

Debian GNU/Linux 3.0 (stable)

Kildekode:
http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49-8.2.dsc
http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49-8.2.diff.gz
Arkitekturuafhængig komponent:
http://security.debian.org/pool/updates/main/m/mysql/mysql-doc_3.23.49-8.2_all.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-common_3.23.49-8.2_all.deb
alpha (DEC Alpha):
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_alpha.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_alpha.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_alpha.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_alpha.deb
arm (ARM):
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_arm.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_arm.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_arm.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_arm.deb
hppa (HP PA RISC):
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_hppa.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_hppa.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_hppa.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_hppa.deb
i386 (Intel ia32):
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_i386.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_i386.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_i386.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_i386.deb
ia64 (Intel ia64):
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_ia64.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_ia64.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_ia64.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_ia64.deb
m68k (Motorola Mc680x0):
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_m68k.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_m68k.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_m68k.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_m68k.deb
mipsel (MIPS (Little Endian)):
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_mipsel.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_mipsel.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_mipsel.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_mipsel.deb
powerpc (PowerPC):
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_powerpc.deb
s390 (IBM S/390):
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_s390.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_s390.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_s390.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_s390.deb
sparc (Sun SPARC/UltraSPARC):
http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_sparc.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_sparc.deb
http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_sparc.deb
http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.