Debian セキュリティ勧告
DSA-831-1 mysql-dfsg -- バッファオーバフロー
- 報告日時:
- 2005-09-30
- 影響を受けるパッケージ:
- mysql-dfsg
- 危険性:
- あり
- 参考セキュリティデータベース:
- (SecurityFocus の) Bugtraq データベース: BugTraq ID 14509.
Mitre の CVE 辞書: CVE-2005-2558. - 詳細:
-
人気のあるデータベース MySQL の init_syms 関数にスタックベースのバッファオーバフローが発見されました。 ユーザ定義関数の作成が可能なリモートの認証済みユーザに、長い function_name フィールドを経由した任意のコードの実行を許します。 ユーザ定義関数の作成は信頼していないユーザには通常認められていません。
以下の表で、各ディストリビューションでどのバージョンの MySQL がこの問題について修正されているのかを示します:
woody sarge sid mysql 3.23.49-8.14 該当無し 該当無し mysql-dfsg 該当無し 4.0.24-10sarge1 4.0.24-10sarge1 mysql-dfsg-4.1 該当無し 4.1.11a-4sarge2 4.1.14-2 mysql-dfsg-5.0 該当無し 該当無し 5.0.11beta-3 直ちに mysql-dfsg パッケージをアップグレードすることを勧めます。
- 修正:
-
Debian GNU/Linux 3.1 (sarge)
- ソース:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-dfsg_4.0.24-10sarge1.dsc
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-dfsg_4.0.24-10sarge1.diff.gz
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-dfsg_4.0.24.orig.tar.gz
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-dfsg_4.0.24-10sarge1.diff.gz
- アーキテクチャ非依存コンポーネント:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-common_4.0.24-10sarge1_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_alpha.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_alpha.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_alpha.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_alpha.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_alpha.deb
- AMD64:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_amd64.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_amd64.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_amd64.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_amd64.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_amd64.deb
- ARM:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_arm.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_arm.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_arm.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_arm.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_i386.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_i386.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_i386.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_i386.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_ia64.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_ia64.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_ia64.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_ia64.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_hppa.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_hppa.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_hppa.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_hppa.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_m68k.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_m68k.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_m68k.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_m68k.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_mips.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_mips.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_mips.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_mips.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_mipsel.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_mipsel.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_mipsel.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_mipsel.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_powerpc.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_powerpc.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_powerpc.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_powerpc.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_s390.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_s390.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_s390.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_s390.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10sarge1_sparc.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_sparc.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-client_4.0.24-10sarge1_sparc.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/mysql-server_4.0.24-10sarge1_sparc.deb
- http://security.debian.org/pool/updates/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10sarge1_sparc.deb
一覧にあるファイルの MD5 チェックサムは勧告の原文にあります。