1. Ubuntu Security Notices
  2. USN-528-1

USN-528-1: MySQL vulnerabilities

Publication date

11 October 2007

Overview

MySQL vulnerabilities

Releases

Packages

Details

Neil Kettle discovered that MySQL could be made to dereference a NULL
pointer and divide by zero. An authenticated user could exploit this
with a crafted IF clause, leading to a denial of service. (CVE-2007-2583)

Victoria Reznichenko discovered that MySQL did not always require the
DROP privilege. An authenticated user could exploit this via RENAME
TABLE statements to rename arbitrary tables, possibly gaining additional
database access. (CVE-2007-2691)

It was discovered that MySQL could be made to overflow a signed char
during authentication. Remote attackers could use crafted authentication
requests to cause a denial of service. (CVE-2007-3780)

Phil Anderton discovered that MySQL did not properly verify access
privileges when accessing external tables. As a result, authenticated
users could exploit this to...

Neil Kettle discovered that MySQL could be made to dereference a NULL
pointer and divide by zero. An authenticated user could exploit this
with a crafted IF clause, leading to a denial of service. (CVE-2007-2583)

Victoria Reznichenko discovered that MySQL did not always require the
DROP privilege. An authenticated user could exploit this via RENAME
TABLE statements to rename arbitrary tables, possibly gaining additional
database access. (CVE-2007-2691)

It was discovered that MySQL could be made to overflow a signed char
during authentication. Remote attackers could use crafted authentication
requests to cause a denial of service. (CVE-2007-3780)

Phil Anderton discovered that MySQL did not properly verify access
privileges when accessing external tables. As a result, authenticated
users could exploit this to obtain UPDATE privileges to external
tables. (CVE-2007-3782)

In certain situations, when installing or upgrading mysql, there was no
notification that the mysql root user password needed to be set. If the
password was left unset, attackers would be able to obtain unrestricted
access to mysql. This is now checked during mysql start-up.

Update instructions

In general, a standard system upgrade is sufficient to effect the necessary changes.

Learn more about how to get the fixes.

ATTENTION: A change was made to the init script for mysql. Now on start-up, mysql is checked to make sure that the mysql root password is set. If it is blank, a message is sent to the console and the system logger alerting that the password is not set, along with instructions on how to set it. Additionally, you can now use: sudo /etc/init.d/mysql reset-password to set the root mysql user's password.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
7.04 feisty mysql-server-5.0 –  5.0.38-0ubuntu1.1
6.10 edgy mysql-server-5.0 –  5.0.24a-9ubuntu2.1
6.06 dapper mysql-server-5.0 –  5.0.22-0ubuntu6.06.5

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›