Debians sikkerhedsbulletin
DSA-212-1 mysql -- flere problemer
- Rapporteret den:
- 17. dec 2002
- Berørte pakker:
- mysql
- Sårbar:
- Ja
- Referencer i sikkerhedsdatabaser:
- I Bugtraq-databasen (hos SecurityFocus): BugTraq-id 6373, BugTraq-id 6368, BugTraq-id 6375.
I Mitres CVE-ordbog: CVE-2002-1373, CVE-2002-1374, CVE-2002-1375, CVE-2002-1376. - Yderligere oplysninger:
-
Ved en gennemgang af MySQL fandt e-matters flere problemer:
- fortegnsproblem i COM_TABLE_DUMP
- To størrelser blev betragtet som heltalsværdier med fortegn fra en forespørgsel og dernæst typekonverteret til et heltal uden fortegn, uden at kontrollere for negative tal. Da det resulterende tal blev brugt i en memcpy()-handling, kunne det føre til ødelæggelse af hukommelsen.
- Håndtering af adgangskodelængde i COM_CHANGE_USER
- Ved genautentifikation til en anden bruger, udførte MySQL ikke alle
kontroller som udføres ved den indledende autentifikation. Dette medførte to
problemer:
- det var muligt ved hjælp af "brute force"-metoden, et tegn ad gangen at finde frem til adgangskoden (det rettede vi ved den indledende login i februar 2000), hvilket kunne anvendes af en normal bruger til at opnå root-rettigheder til databasen
- det var muligt at få adgangskodebufferen til at løbe over og tvinge serveren til at udføre vilkårlig kode.
- read_rows()-overløb i libmysqlclient
- Ved behandling af rækker returneret af en SQL-server, var der ingen kontrol af unormalt store rækker eller afsluttende NUL-tegn. Dette kunne anvendes til at udnytte SQL-klienter, hvis de forbandt sig til udnyttede MySQL-server.
- read_one_row()-overløb i libmysqlclient
- Ved behandling af en række returneret af en SQL-server, blev de returnerede feltstørrelser ikke kontrolleret. Dette kunne anvendes til at udnytte SQL-klienter, hvis de forbandt sig til den udnyttede MySQL-server.
I Debian GNU/Linux 3.0/woody er dette rettet i version 3.23.49-8.2 og version 3.22.32-6.3 i Debian GNU/Linux 2.2/potato.
Vi anbefaler at du opgraderer dine mysql-pakker så hurtigt som muligt.
- Rettet i:
-
Debian GNU/Linux 2.2 (oldstable)
- Kildekode:
- http://security.debian.org/pool/updates/main/m/mysql/mysql_3.22.32-6.3.dsc
- http://security.debian.org/pool/updates/main/m/mysql/mysql_3.22.32.orig.tar.gz
- http://security.debian.org/pool/updates/main/m/mysql/mysql_3.22.32-6.3.diff.gz
- http://security.debian.org/pool/updates/main/m/mysql/mysql_3.22.32.orig.tar.gz
- Arkitekturuafhængig komponent:
- http://security.debian.org/pool/updates/main/m/mysql/mysql-doc_3.22.32-6.3_all.deb
- alpha (DEC Alpha):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_alpha.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_alpha.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_alpha.deb
- arm (ARM):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_arm.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_arm.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_arm.deb
- i386 (Intel ia32):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_i386.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_i386.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_i386.deb
- m68k (Motorola Mc680x0):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_m68k.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_m68k.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_m68k.deb
- powerpc (PowerPC):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_powerpc.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_powerpc.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_powerpc.deb
- sparc (Sun SPARC/UltraSPARC):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.22.32-6.3_sparc.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_sparc.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.22.32-6.3_sparc.deb
Debian GNU/Linux 3.0 (stable)
- Kildekode:
- http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49-8.2.dsc
- http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49-8.2.diff.gz
- http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49-8.2.diff.gz
- Arkitekturuafhængig komponent:
- http://security.debian.org/pool/updates/main/m/mysql/mysql-doc_3.23.49-8.2_all.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-common_3.23.49-8.2_all.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-common_3.23.49-8.2_all.deb
- alpha (DEC Alpha):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_alpha.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_alpha.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_alpha.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_alpha.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_alpha.deb
- arm (ARM):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_arm.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_arm.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_arm.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_arm.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_arm.deb
- hppa (HP PA RISC):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_hppa.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_hppa.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_hppa.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_hppa.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_hppa.deb
- i386 (Intel ia32):
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_i386.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_i386.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_i386.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_i386.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_i386.deb
- ia64 (Intel ia64):
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_ia64.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_ia64.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_ia64.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_ia64.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_ia64.deb
- m68k (Motorola Mc680x0):
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_m68k.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_m68k.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_m68k.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_m68k.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_m68k.deb
- mipsel (MIPS (Little Endian)):
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_mipsel.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_mipsel.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_mipsel.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_mipsel.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_mipsel.deb
- powerpc (PowerPC):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_powerpc.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_powerpc.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_powerpc.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_powerpc.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_powerpc.deb
- s390 (IBM S/390):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_s390.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_s390.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_s390.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_s390.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_s390.deb
- sparc (Sun SPARC/UltraSPARC):
- http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.2_sparc.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_sparc.deb
- http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.2_sparc.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.2_sparc.deb
- http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.2_sparc.deb
MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.