Debians sikkerhedsbulletin

DSA-1071-1 mysql -- flere sårbarheder

Rapporteret den:

22. maj 2006

Berørte pakker:

Sårbar:

Referencer i sikkerhedsdatabaser:

I Debians fejlsporingssystem: Fejl 366044, Fejl 366049, Fejl 366163.
I Bugtraq-databasen (hos SecurityFocus): BugTraq-id 16850, BugTraq-id 17780.
I Mitres CVE-ordbog: CVE-2006-0903, CVE-2006-1516, CVE-2006-1517, CVE-2006-1518.

Yderligere oplysninger:

Flere sårbarheder er opdaget i MySQL, en populær SQL-database. Common Vulnerabilities and Exposures Project har fundet frem til følgende problemer:

CVE-2006-0903
Ukorrekt håndtering af SQL-forespørgsler indeholder NULL-tegnet gjorde det muligt for lokale brugere at omgå logningsmekanismer.
CVE-2006-1516
Brugernavne uden en afsluttende null-byte gjorde det muligt for fjernangribere at læse dele af hukommelsen.
CVE-2006-1517
En forespørgsel med en ukorrekt pakkelængde gjorde det muligt for fjernangribere at få adgang til følsomme oplysninger.
CVE-2006-1518
Særligt fremstillede forespørgselspakker med ugyldige længdeværdier tillod udførelse af vilkårlig kode.

Følgende sårbarhedsmatriks viser hvor problemerne er rettet i hvilke versioner af MySQL og i hvilke distributioner:

	woody	sarge	sid
mysql	3.23.49-8.15	n/a	n/a
mysql-dfsg	n/a	4.0.24-10sarge2	n/a
mysql-dfsg-4.1	n/a	4.1.11a-4sarge3	n/a
mysql-dfsg-5.0	n/a	n/a	5.0.21-3

Vi anbefaler at du opgraderer dine mysql-pakker.

Rettet i:

Debian GNU/Linux 3.0 (woody)

Kildekode:: http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49-8.15.dsc; http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49-8.15.diff.gz; http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49.orig.tar.gz
Arkitekturuafhængig komponent:: http://security.debian.org/pool/updates/main/m/mysql/mysql-common_3.23.49-8.15_all.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-doc_3.23.49-8.5_all.deb
Alpha:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_alpha.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_alpha.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_alpha.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_arm.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_arm.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_arm.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_i386.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_i386.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_i386.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_ia64.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_ia64.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_ia64.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_ia64.deb
HPPA:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_hppa.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_hppa.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_hppa.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_m68k.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_m68k.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_m68k.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_mips.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_mips.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_mips.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_mipsel.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_mipsel.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_mipsel.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_powerpc.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_powerpc.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_powerpc.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_s390.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_s390.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_s390.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.15_sparc.deb; http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.15_sparc.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.15_sparc.deb; http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.15_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.