[ISN] MySQL open to attack

From: InfoSec News (isnat_private)
Date: Tue Dec 17 2002 - 03:27:56 PST

  • Next message: InfoSec News: "[ISN] Researchers Warn of Serious SSH Flaws"

    http://www.zdnet.com.au/newstech/security/story/0,2000024985,20270704,00.htm
    
    By Patrick Gray
    ZDNet Australia
    16 December 2002
        
    Several vulnerabilities have been found in the MySQL database system,
    a light database package commonly used in Linux environments but which
    runs also on Microsoft platforms, HP-Unix, Mac OS and more.
    
    E-matters, a German company, released a security advisory after
    discovering the security flaws. They have rated the vulnerabilities as
    "Medium to Critical" in severity.
    
    The security flaws discovered by the company range from Denial of
    Service (DoS) problems to more serious issues.
    
    "...one of the flaws can be used to bypass the MySQL password check or
    to execute arbitrary code," the advisory said.
    
    E-matters also found multiple vulnerabilities in the MySQL client
    libraries, which "...could allow DoS attacks against or arbitrary code
    execution within anything linked against libmysqlclient."
    
    The vulnerabilities affect all versions prior to 3.23.53a and 4.0.5a.  
    MySQL have released an updated "version 3" (3.23.54) that is immune to
    the security bugs.
    
    It is not known when an updated "version 4" MySQL will be released.
    
    E-matters will not be releasing an exploit for the vulnerability.
     
     
    
    -
    ISN is currently hosted by Attrition.org
    
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.
    



    This archive was generated by hypermail 2b30 : Wed Dec 18 2002 - 13:10:50 PST