CVE-2005-0709
CVSS4.6
发布时间 :2005-05-02 00:00:00
修订时间 :2016-10-17 23:13:53
NMCOPS    

[原文]MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated by using strcat, on_exit, and exit.


[CNNVD]MySQL CREATE FUNCTION功能libc函数库允许执行任意代码漏洞(CNNVD-200505-038)

        MySQL是一款使用非常广泛的开放源代码关系数据库系统,拥有各种平台的运行版本。
        MySQL数据库的CREATE FUNCTION命令用于在MySQL中实现用户自定义函数的管理,MySQL对用户自定义函数的引入和参数使用实现有问题,拥有数据库管理员权限的用户可能利用漏洞在运行MySQL数据库的主机上以MySQL进程的权限执行任意指令。
        如果经过认证的用户对MySQL管理数据库'mysql'拥有INSERT和DELETE的权限的话,就可能通过注入畸形的CREATE FUNCTION命令参数,利用libc中的函数获取MySQL进程的执行权限。
        

- CVSS (基础分值)

CVSS分值: 4.6 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CWE (弱点类目)

CWE-94 [对生成代码的控制不恰当(代码注入)]

- CPE (受影响的平台与产品)

cpe:/a:mysql:mysql:3.23.49MySQL MySQL 3.23.49
cpe:/a:mysql:mysql:4.1.2:alphaMySQL MySQL 4.1.2 alpha
cpe:/a:mysql:mysql:4.1.0:alphaMySQL MySQL 4.1.0 alpha
cpe:/a:mysql:mysql:4.0.23MySQL MySQL 4.0.23
cpe:/a:mysql:mysql:4.1.3:betaMySQL MySQL 4.1.3 beta
cpe:/a:mysql:mysql:4.0.21MySQL MySQL 4.0.21
cpe:/a:mysql:mysql:4.0.7:gammaMySQL MySQL 4.0.7 gamma
cpe:/a:mysql:mysql:4.1.10MySQL MySQL 4.1.10
cpe:/a:mysql:mysql:4.0.20MySQL MySQL 4.0.20
cpe:/a:mysql:mysql:4.0.15MySQL MySQL 4.0.15
cpe:/a:mysql:mysql:4.0.18MySQL MySQL 4.0.18
cpe:/a:mysql:mysql:4.0.5MySQL MySQL 4.0.5
cpe:/a:mysql:mysql:4.1.4MySQL MySQL 4.1.4
cpe:/a:mysql:mysql:4.0.4MySQL MySQL 4.0.4
cpe:/a:mysql:mysql:4.0.5aMySQL MySQL 4.0.5a
cpe:/a:mysql:mysql:4.1.3MySQL MySQL 4.1.3
cpe:/a:mysql:mysql:4.0.7MySQL MySQL 4.0.7
cpe:/a:mysql:mysql:4.0.6MySQL MySQL 4.0.6
cpe:/a:mysql:mysql:4.1.5MySQL MySQL 4.1.5
cpe:/a:mysql:mysql:4.0.1MySQL MySQL 4.0.1
cpe:/a:mysql:mysql:4.0.0MySQL MySQL 4.0.0
cpe:/a:mysql:mysql:4.0.3MySQL MySQL 4.0.3
cpe:/a:mysql:mysql:4.0.2MySQL MySQL 4.0.2
cpe:/a:mysql:mysql:4.0.12MySQL MySQL 4.0.12
cpe:/a:mysql:mysql:4.0.11MySQL MySQL 4.0.11
cpe:/a:mysql:mysql:4.0.14MySQL MySQL 4.0.14
cpe:/a:mysql:mysql:4.0.13MySQL MySQL 4.0.13
cpe:/a:mysql:mysql:4.0.10MySQL MySQL 4.0.10
cpe:/a:mysql:mysql:4.0.9:gammaMySQL MySQL 4.0.9 gamma
cpe:/a:mysql:mysql:4.0.11:gammaMySQL MySQL 4.0.11 gamma
cpe:/a:mysql:mysql:4.0.8:gammaMySQL MySQL 4.0.8 gamma
cpe:/a:mysql:mysql:4.0.9MySQL MySQL 4.0.9
cpe:/a:mysql:mysql:4.0.8MySQL MySQL 4.0.8
cpe:/a:mysql:mysql:4.1.0.0MySQL MySQL 4.1.0.0

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:10479MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary c...
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0709
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-0709
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200505-038
(官方数据源) CNNVD

- 其它链接及资源

http://archives.neohapsis.com/archives/vulnwatch/2005-q1/0084.html
(UNKNOWN)  VULNWATCH  20050310 Mysql CREATE FUNCTION libc arbitrary code execution.
http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html
(UNKNOWN)  APPLE  APPLE-SA-2005-08-17
http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
(UNKNOWN)  APPLE  APPLE-SA-2005-08-15
http://marc.info/?l=bugtraq&m=111066115808506&w=2
(UNKNOWN)  BUGTRAQ  20050310 Mysql CREATE FUNCTION libc arbitrary code execution.
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101864-1
(UNKNOWN)  SUNALERT  101864
http://www.debian.org/security/2005/dsa-707
(PATCH)  DEBIAN  DSA-707
http://www.gentoo.org/security/en/glsa/glsa-200503-19.xml
(PATCH)  GENTOO  GLSA-200503-19
http://www.mandriva.com/security/advisories?name=MDKSA-2005:060
(UNKNOWN)  MANDRAKE  MDKSA-2005:060
http://www.novell.com/linux/security/advisories/2005_19_mysql.html
(PATCH)  SUSE  SUSE-SA:2005:019
http://www.redhat.com/support/errata/RHSA-2005-334.html
(UNKNOWN)  REDHAT  RHSA-2005:334
http://www.redhat.com/support/errata/RHSA-2005-348.html
(UNKNOWN)  REDHAT  RHSA-2005:348
http://www.securityfocus.com/bid/12781
(PATCH)  BID  12781
http://www.trustix.org/errata/2005/0009/
(PATCH)  TRUSTIX  2005-0009
http://www.ubuntulinux.org/support/documentation/usn/usn-96-1
(UNKNOWN)  UBUNTU  USN-96-1

- 漏洞信息

MySQL CREATE FUNCTION功能libc函数库允许执行任意代码漏洞
中危 资料不足
2005-05-02 00:00:00 2006-06-15 00:00:00
远程  
        MySQL是一款使用非常广泛的开放源代码关系数据库系统,拥有各种平台的运行版本。
        MySQL数据库的CREATE FUNCTION命令用于在MySQL中实现用户自定义函数的管理,MySQL对用户自定义函数的引入和参数使用实现有问题,拥有数据库管理员权限的用户可能利用漏洞在运行MySQL数据库的主机上以MySQL进程的权限执行任意指令。
        如果经过认证的用户对MySQL管理数据库'mysql'拥有INSERT和DELETE的权限的话,就可能通过注入畸形的CREATE FUNCTION命令参数,利用libc中的函数获取MySQL进程的执行权限。
        

- 公告与补丁

        目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:
        http://www.mysql.com/

- 漏洞信息 (F37204)

dsa-707.txt (PacketStormID:F37204)
2005-04-19 00:00:00
 
advisory,arbitrary
linux,debian
CVE-2004-0957,CVE-2005-0957,CVE-2005-0709,CVE-2005-0710,CVE-2005-0711
[点击下载]

Debian Security Advisory 707-1. Multiple issues with MySQL, including: incorrect privilege handling (users get illegitimate access to databases named similarly to those they have legitimate access to), arbitrary command execution for any user that has been granted INSERT and DELETE rights, and race conditions due to predictable tempfile naming schemes.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 707-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
April 13th, 2005                        http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : mysql
Vulnerability  : several
Problem-Type   : remote
Debian-specific: no
CVE ID         : CAN-2004-0957
BugTraq ID     : 12781
Debian Bug     : 285276 296674 300158

Several vulnerabilities have been discovered in MySQL, a popular
database.  The Common Vulnerabilities and Exposures project identifies
the following problems:

CAN-2004-0957

    Sergei Golubchik discovered a problem in the access handling for
    similar named databases.  If a user is granted privileges to a
    database with a name containing an underscore ("_"), the user also
    gains privileges to other databases with similar names.

CAN-2005-0709

    Stefano Di Paola discovered that MySQL allows remote
    authenticated users with INSERT and DELETE privileges to execute
    arbitrary code by using CREATE FUNCTION to access libc calls.

CAN-2005-0710

    Stefano Di Paola discovered that MySQL allows remote authenticated
    users with INSERT and DELETE privileges to bypass library path
    restrictions and execute arbitrary libraries by using INSERT INTO
    to modify the mysql.func table.

CAN-2005-0711

   Stefano Di Paola discovered that MySQL uses predictable file names
   when creating temporary tables, which allows local users with
   CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via
   a symlink attack.

For the stable distribution (woody) these problems have been fixed in
version 3.23.49-8.11.

For the unstable distribution (sid) these problems have been fixed in
version 4.0.24-5 of mysql-dfsg and in version 4.1.10a-6 of
mysql-dfsg-4.1.

We recommend that you upgrade your mysql packages.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49-8.11.dsc
      Size/MD5 checksum:      877 df2d85bd322eb6d42287127aa911b07e
    http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49-8.11.diff.gz
      Size/MD5 checksum:    84421 13e0ec8441a97408ed4d0ab47981a333
    http://security.debian.org/pool/updates/main/m/mysql/mysql_3.23.49.orig.tar.gz
      Size/MD5 checksum: 11861035 a2820d81997779a9fdf1f4b3c321564a

  Architecture independent components:

    http://security.debian.org/pool/updates/main/m/mysql/mysql-common_3.23.49-8.11_all.deb
      Size/MD5 checksum:    18094 578cfd9bbf7930981efc682c8e51b549
    http://security.debian.org/pool/updates/main/m/mysql/mysql-doc_3.23.49-8.5_all.deb
      Size/MD5 checksum:  1962992 a4cacebaadf9d5988da0ed1a336b48e6

  Alpha architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_alpha.deb
      Size/MD5 checksum:   279398 3971a1aa23bde9baefeb5784ef0ade3a
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_alpha.deb
      Size/MD5 checksum:   780772 97e71d14a7a1d4dd21ed5deab8dd545e
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_alpha.deb
      Size/MD5 checksum:   164748 7162245a011bed2fe08d0de4f95cc4e1
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_alpha.deb
      Size/MD5 checksum:  3636734 66c25c69c3579a9d69cd5b258ff5aaee

  ARM architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_arm.deb
      Size/MD5 checksum:   239882 4472b428cbb26a752ac0e81b051cf628
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_arm.deb
      Size/MD5 checksum:   636536 ca50af2c717731c69542d5724a47fdf6
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_arm.deb
      Size/MD5 checksum:   125156 e72c65ef2ec3bb5d2a4a98263ccadb2b
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_arm.deb
      Size/MD5 checksum:  2808394 49c9bfb44afb893144171137b98eed12

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_i386.deb
      Size/MD5 checksum:   236058 a166e82ba1b7444bf86273f6e2d06022
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_i386.deb
      Size/MD5 checksum:   578064 a95797aa335d8f09ec119c553a766b08
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_i386.deb
      Size/MD5 checksum:   123672 3bd8648dd73e9f8f435029907d7d8a32
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_i386.deb
      Size/MD5 checksum:  2802056 dd4a223b162e6e13e0517220cc756fd3

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_ia64.deb
      Size/MD5 checksum:   316690 8c537c85c8485fc053b05aa7647e9c95
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_ia64.deb
      Size/MD5 checksum:   850412 9b580b32697b20bd420682e2da02b55a
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_ia64.deb
      Size/MD5 checksum:   174958 4529edb2a8ed5275b858ddda14cafc9c
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_ia64.deb
      Size/MD5 checksum:  4001168 dffcaa4ea670a963c2e1c87f86ca790b

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_hppa.deb
      Size/MD5 checksum:   282304 3192982a2bf0d1f4b4c898ffa45ee977
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_hppa.deb
      Size/MD5 checksum:   745680 1746b48072bcc93c4588d1e6f0c12b44
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_hppa.deb
      Size/MD5 checksum:   141770 b497d2bdd7032816a696985a65e32174
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_hppa.deb
      Size/MD5 checksum:  3516268 216cbce37769115fe9d393b9193f4ad5

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_m68k.deb
      Size/MD5 checksum:   229238 0c5ae0cdfb69ee2e8eaff52119bbfdf5
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_m68k.deb
      Size/MD5 checksum:   559260 11b3be08f6cd4c916a56349908e73bc7
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_m68k.deb
      Size/MD5 checksum:   119552 291df2ccd20afd3ba5b426bc232e1681
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_m68k.deb
      Size/MD5 checksum:  2648664 32253029744281d67cc32516d4415a7b

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_mips.deb
      Size/MD5 checksum:   252512 9f0d13488d1ef1d46b1cf954247c5d73
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_mips.deb
      Size/MD5 checksum:   690782 65245ff95983c58c49e5675e61ee3629
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_mips.deb
      Size/MD5 checksum:   135060 5382f4e78411fcb8364df226d27b6480
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_mips.deb
      Size/MD5 checksum:  2850534 1f6cbd34b484d6f57259c9c10d49c643

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_mipsel.deb
      Size/MD5 checksum:   252176 fe3be8acd75ccb1206d32b66f4a7f696
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_mipsel.deb
      Size/MD5 checksum:   690178 9bc96dee918e627234f5aba08e8ed174
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_mipsel.deb
      Size/MD5 checksum:   135402 219d4706babc06c8995c8674687bdd3b
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_mipsel.deb
      Size/MD5 checksum:  2840476 f9feb1a4254acb12cd974fe7abdd7430

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_powerpc.deb
      Size/MD5 checksum:   249246 d2433c23f8a83fbb7cfabaa7f1996ba0
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_powerpc.deb
      Size/MD5 checksum:   654366 fc5f0eb155c521a8a2f2a621c58026ef
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_powerpc.deb
      Size/MD5 checksum:   130604 06d0a734db8a480d31acfff1a032a1b2
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_powerpc.deb
      Size/MD5 checksum:  2825402 7cb05dadadbdf7b2aeaebff9b1c57bdd

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_s390.deb
      Size/MD5 checksum:   251522 0b0425e22e503cca3044457d1afb96a0
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_s390.deb
      Size/MD5 checksum:   609212 f2e48ad9b41cd1aed57b0cf06a350c51
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_s390.deb
      Size/MD5 checksum:   127578 e716610259ca1a56a5cc709bb0f39d8f
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_s390.deb
      Size/MD5 checksum:  2692988 dc5da2e28c240fc7cd5d7a57038324c4

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10_3.23.49-8.11_sparc.deb
      Size/MD5 checksum:   242480 7fdfd764be3bc3eaccb2370b6d55f501
    http://security.debian.org/pool/updates/main/m/mysql/libmysqlclient10-dev_3.23.49-8.11_sparc.deb
      Size/MD5 checksum:   617570 900be3d64a19cc29f7e20449a3cb95e0
    http://security.debian.org/pool/updates/main/m/mysql/mysql-client_3.23.49-8.11_sparc.deb
      Size/MD5 checksum:   131548 890954cb23d89714d7645fa60587854c
    http://security.debian.org/pool/updates/main/m/mysql/mysql-server_3.23.49-8.11_sparc.deb
      Size/MD5 checksum:  2942040 5f234f648e9d269ca3df7167536bd2ae


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFCXTBsW5ql+IAeqTIRAqe7AJ43f0oqBefOL1Il+OK4u4IkUD2PQgCfcq76
uT5622whCYqRR/Irsz2E7I8=
=7FKX
-----END PGP SIGNATURE-----

    

- 漏洞信息 (F36662)

Gentoo Linux Security Advisory 200503-19 (PacketStormID:F36662)
2005-03-22 00:00:00
Gentoo  security.gentoo.org
advisory
linux,gentoo
CVE-2005-0709,CVE-2005-0710,CVE-2005-0711
[点击下载]

Gentoo Linux Security Advisory GLSA 200503-19 - MySQL fails to properly validate input for authenticated users with INSERT and DELETE privileges (CVE-2005-0709 and CVE-2005-0710). Furthermore MySQL uses predictable filenames when creating temporary files with CREATE TEMPORARY TABLE (CVE-2005-0711). Versions less than 4.0.24 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200503-19
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: MySQL: Multiple vulnerabilities
      Date: March 16, 2005
      Bugs: #84819
        ID: 200503-19

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

MySQL contains several vulnerabilities potentially leading to the
overwriting of local files or to the execution of arbitrary code.

Background
==========

MySQL is a fast, multi-threaded, multi-user SQL database server.

Affected packages
=================

    -------------------------------------------------------------------
     Package       /  Vulnerable  /                         Unaffected
    -------------------------------------------------------------------
  1  dev-db/mysql      < 4.0.24                              >= 4.0.24

Description
===========

MySQL fails to properly validate input for authenticated users with
INSERT and DELETE privileges (CAN-2005-0709 and CAN-2005-0710).
Furthermore MySQL uses predictable filenames when creating temporary
files with CREATE TEMPORARY TABLE (CAN-2005-0711).

Impact
======

At attacker with INSERT and DELETE privileges could exploit this to
manipulate the mysql table or accessing libc calls, potentially leading
to the execution of arbitrary code with the permissions of the user
running MySQL. An attacker with CREATE TEMPORARY TABLE privileges could
exploit this to overwrite arbitrary files via a symlink attack.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All MySQL users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-db/mysql-4.0.24"

References
==========

  [ 1 ] CAN-2005-0709
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0709
  [ 2 ] CAN-2005-0710
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0710
  [ 3 ] CAN-2005-0711
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0711

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200503-19.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0
    

- 漏洞信息

14678
MySQL CREATE FUNCTION Arbitrary libc Code Execution
Remote / Network Access Input Manipulation
Loss of Confidentiality, Loss of Integrity
Exploit Public Vendor Verified

- 漏洞描述

MySQL contains a flaw that may allow a malicious user to load arbitrary libraries. The issue is triggered when an authenticated user with INSERT and DELETE privileges use the CREATE FUNCTION command to specify and load an arbitrary custom library. It is possible that the flaw may allow a remote attacker to execute arbitrary code, resulting in a loss of confidentiality and/or integrity.

- 时间线

2005-03-11 Unknow
2005-03-11 Unknow

- 解决方案

Upgrade to versions 4.0.24, 4.1.10 or higher, as they have been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s): "Do not grant untrusted users privileges to perform "CREATE TEMPORARY TABLE" statements and manipulate the "mysql" administrative database."

- 相关参考

- 漏洞作者

- 漏洞信息

MySQL AB MySQL Multiple Remote Vulnerabilities
Unknown 12781
Yes No
2005-03-11 12:00:00 2007-11-02 10:06:00
Discovery of these vulnerabilities is credited to Stefano Di Paola <stefano.dipaolawisec.it>.

- 受影响的程序版本

Turbolinux Turbolinux Workstation 8.0
Turbolinux Turbolinux Workstation 7.0
Turbolinux Turbolinux Server 10.0
Turbolinux Turbolinux Server 8.0
Turbolinux Turbolinux Server 7.0
Turbolinux Turbolinux Desktop 10.0
Turbolinux Turbolinux 10 F...
Turbolinux Home
Turbolinux Appliance Server Workgroup Edition 1.0
Turbolinux Appliance Server Hosting Edition 1.0
Trustix Secure Linux 2.2
Trustix Secure Linux 2.1
Trustix Secure Linux 2.0
Trustix Secure Enterprise Linux 2.0
SuSE SUSE Linux Enterprise Server 8
+ Linux kernel 2.4.21
+ Linux kernel 2.4.19
Sun Solaris 10.0_x86
Sun Solaris 10
SGI ProPack 3.0
S.u.S.E. Novell Linux Desktop 9.0
S.u.S.E. Linux Personal 9.2 x86_64
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 9.1 x86_64
S.u.S.E. Linux Personal 9.1
S.u.S.E. Linux Personal 9.0 x86_64
S.u.S.E. Linux Personal 9.0
S.u.S.E. Linux Personal 8.2
S.u.S.E. Linux Enterprise Server 9
S.u.S.E. Linux Desktop 1.0
RedHat Linux 8.0 i686
RedHat Linux 8.0 i386
RedHat Linux 8.0
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux WS 3
RedHat Enterprise Linux WS 2.1 IA64
RedHat Enterprise Linux WS 2.1
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux ES 3
RedHat Enterprise Linux ES 2.1 IA64
RedHat Enterprise Linux ES 2.1
RedHat Desktop 4.0
RedHat Desktop 3.0
RedHat Advanced Workstation for the Itanium Processor 2.1 IA64
RedHat Advanced Workstation for the Itanium Processor 2.1
Red Hat Fedora Core3
Red Hat Fedora Core2
MySQL AB MySQL 4.1.5
MySQL AB MySQL 4.1.4
MySQL AB MySQL 4.1.3 -beta
MySQL AB MySQL 4.1.3 -beta
MySQL AB MySQL 4.1.3 -0
MySQL AB MySQL 4.1.2 -alpha
MySQL AB MySQL 4.0.21
MySQL AB MySQL 4.0.20
+ Mandriva Linux Mandrake 10.1 x86_64
+ Mandriva Linux Mandrake 10.1
+ Ubuntu Ubuntu Linux 4.1 ppc
+ Ubuntu Ubuntu Linux 4.1 ia64
+ Ubuntu Ubuntu Linux 4.1 ia32
MySQL AB MySQL 4.0.18
+ MandrakeSoft Corporate Server 3.0 x86_64
+ MandrakeSoft Corporate Server 3.0
+ Mandriva Linux Mandrake 10.0 AMD64
+ Mandriva Linux Mandrake 10.0
MySQL AB MySQL 4.0.15
+ Conectiva Linux 10.0
+ Mandriva Linux Mandrake 9.2 amd64
+ Mandriva Linux Mandrake 9.2
+ OpenPKG OpenPKG Current
MySQL AB MySQL 4.0.14
MySQL AB MySQL 4.0.13
MySQL AB MySQL 4.0.12
MySQL AB MySQL 4.0.11 -gamma
MySQL AB MySQL 4.0.11
+ Mandriva Linux Mandrake 9.1 ppc
+ Mandriva Linux Mandrake 9.1
MySQL AB MySQL 4.0.10
MySQL AB MySQL 4.0.9 -gamma
MySQL AB MySQL 4.0.9
MySQL AB MySQL 4.0.8 -gamma
MySQL AB MySQL 4.0.8
MySQL AB MySQL 4.0.7 -gamma
MySQL AB MySQL 4.0.7
MySQL AB MySQL 4.0.6
MySQL AB MySQL 4.0.5 a
MySQL AB MySQL 4.0.5
MySQL AB MySQL 4.0.4
MySQL AB MySQL 4.0.3
MySQL AB MySQL 4.0.2
MySQL AB MySQL 4.0.1
MySQL AB MySQL 4.0 .0
MySQL AB MySQL 3.23.49
+ Debian Linux 3.0 sparc
+ Debian Linux 3.0 s/390
+ Debian Linux 3.0 ppc
+ Debian Linux 3.0 mipsel
+ Debian Linux 3.0 mips
+ Debian Linux 3.0 m68k
+ Debian Linux 3.0 ia-64
+ Debian Linux 3.0 ia-32
+ Debian Linux 3.0 hppa
+ Debian Linux 3.0 arm
+ Debian Linux 3.0 alpha
+ RedHat Linux 7.3 i686
+ RedHat Linux 7.3 i386
+ RedHat Linux 7.3
MySQL AB MySQL 4.1.0.0-alpha
MySQL AB MySQL 4.1.0-0
Microsoft Windows 2000 Professional SP4
MandrakeSoft Corporate Server 2.1 x86_64
MandrakeSoft Corporate Server 2.1
Gentoo Linux
Conectiva Linux 10.0
Conectiva Linux 9.0
Apple Mac OS X Server 10.3.9
ALT Linux ALT Linux Junior 2.3
ALT Linux ALT Linux Compact 2.3
MySQL AB MySQL 4.0.24
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 amd64
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
MySQL AB MySQL 4.1.10a

- 不受影响的程序版本

MySQL AB MySQL 4.0.24
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 amd64
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
MySQL AB MySQL 4.1.10a

- 漏洞讨论

MySQL is reported prone to multiple vulnerabilities that can be exploited by a remote authenticated attacker. The following individual issues are reported:

- Insecure temporary file-creation vulnerability. Reports indicate that an attacker with 'CREATE TEMPORARY TABLE' privileges on an affected installation may leverage this vulnerability to corrupt files with the privileges of the MySQL process.

- Input-validation vulnerability. Remote attackers with INSERT and DELETE privileges on the 'mysql' administrative database can exploit this. Reports indicate that this issue may be leveraged to load and execute a malicious library in the context of the MySQL process.

- Remote arbitrary-code execution vulnerability. Reportedly, the vulnerability may be triggered by employing the 'CREATE FUNCTION' statement to manipulate functions to control sensitive data structures. This issue may be exploited to execute arbitrary code in the context of the database process.

These issues are reported to exist in MySQL versions prior to MySQL 4.0.24 and 4.1.10a.

- 漏洞利用

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.


The following exploits are available:

- 解决方案

It is reported that the vendor has addressed these vulnerabilities in MySQL versions 4.0.24 and 4.1.10a. These downloads are not available at the time of writing, customers are advised to contact the vendor for further information regarding obtaining and applying appropriate updates.

Turbolinux has released advisory TLSA-2005-48 to address these issues. Please see the referenced advisory for more information.

SGI has released an advisory 20050401-01-U including updated SGI ProPack 3 Service Pack 4 packages to address this issue. Please see the referenced advisory for more information.

ALT Linux has released updates dealing with this and other issues. Please see the reference section for more information.

Gentoo has released advisory GLSA 200503-19 to address these issues. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their systems:

emerge --sync
emerge --ask --oneshot --verbose ">=dev-db/mysql-4.0.24"

Ubuntu has released advisory USN-96-1 to address these issues. Please see the referenced advisory for more information.

Trustix Secure linux released advisory TSL-2005-0009 dealing with this and other issues. Please see the referenced advisory for more information.

Mandrake has released advisory MDKSA-2005:060 to address these issues. Please see the referenced advisory for more information.

SUSE has released advisory SUSE-SA:2005:019 to address these issues. Please see the referenced advisory for more information.

Red Hat has released advisory RHSA-2005:334-07 to address these issues. Please see the referenced advisory for more information.

Conectiva has released advisory CLA-2005:946 to address these issues. Please see the referenced advisory for more information.

Fedora advisories FEDORA-2005-304 and FEDORA-2005-305 for Fedora Core 2 and Core 3 are available to address these issues. Please see the referenced advisories for more information.

Debian Linux has released advisory DSA 707-1 along with fixes dealing with this issue. Please see the referenced advisory for more information.

OpenPKG has released advisory OpenPKG-SA-2005.006 and fixes for this issue. Please see the referenced advisory for information on obtaining the fixed packages.

Sun has released a security advisory (Sun Alert ID: 101864) addressing this and other issues in MySQL for Solaris 10. Please see the referenced advisory for further information.

Apple has released security advisory APPLE-SA-2005-08-15 addressing this and several other vulnerabilities. Please see the referenced advisory for further information.


Sun Solaris 10

Sun Solaris 10.0_x86

Apple Mac OS X Server 10.3.9

MySQL AB MySQL 3.23.49

MySQL AB MySQL 4.0.15

MySQL AB MySQL 4.0.18

MySQL AB MySQL 4.0.20

MySQL AB MySQL 4.0.21

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站