-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1997-1                  security@debian.org
http://www.debian.org/security/                        Giuseppe Iuculano
February 14, 2010                     http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : mysql-dfsg-5.0
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2009-4019 CVE-2009-4030 CVE-2009-4484

Several vulnerabilities have been discovered in the MySQL
database server.
The Common Vulnerabilities and Exposures project identifies the
following problems:


CVE-2009-4019

Domas Mituzas discovered that mysqld does not properly handle errors during
execution of certain SELECT statements with subqueries, and does not preserve
certain null_value flags during execution of statements that use the
GeomFromWKB function, which allows remote authenticated users to cause a
denial of service (daemon crash) via a crafted statement.


CVE-2009-4030

Sergei Golubchik discovered that MySQL allows local users to bypass certain
privilege checks by calling CREATE TABLE on a MyISAM table with modified
DATA DIRECTORY or INDEX DIRECTORY arguments that are originally associated
with pathnames without symlinks, and that can point to tables created at
a future time at which a pathname is modified to contain a symlink to a
subdirectory of the MySQL data home directory.


CVE-2009-4484

Multiple stack-based buffer overflows in the CertDecoder::GetName function
in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld, allow
remote attackers to execute arbitrary code or cause a denial of service
(memory corruption and daemon crash) by establishing an SSL connection and
sending an X.509 client certificate with a crafted name field.


For the oldstable distribution (etch), these problems have been fixed in
version 5.0.32-7etch12

For the stable distribution (lenny), these problems have been fixed in
version 5.0.51a-24+lenny3

The testing (squeeze) and unstable (sid) distribution do not contain
mysql-dfsg-5 anymore.

We recommend that you upgrade your mysql-dfsg-5.0 packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

      Size/MD5 checksum:     1128 4887f5693757fbbc2584e86ab5e91bf3
      Size/MD5 checksum:   315292 3d1c00f7b70032c11803fa391bee026a
      Size/MD5 checksum: 16439441 f99df050b0b847adf7702b44e79ac877

Architecture independent packages:

      Size/MD5 checksum:    48912 f937a118691e4325dac3a5a8e98eeb50
      Size/MD5 checksum:    55892 6f34fbec1b8e451172ebd24f80439a9e
      Size/MD5 checksum:    46842 daa1649e464ebdbbd54170fb571782ea

alpha architecture (DEC Alpha)

      Size/MD5 checksum:  1947910 6e23852721ab3b2a95d1b3113a533212
      Size/MD5 checksum:    48900 c53c847af88a0423a09b9f68ba261859
      Size/MD5 checksum:  8906528 64427684814af516902d10adb5c85de2
      Size/MD5 checksum:  8406242 204adae2eab5bfb665728ea7257631f0
      Size/MD5 checksum: 27248640 ee4b566619b0e560dcbf0632f8b0cc0e

amd64 architecture (AMD x86_64 (AMD64))

      Size/MD5 checksum:  1832552 84dba4bf6dfb24e13f4077e04d0c3475
      Size/MD5 checksum: 25812188 31a0ce355b2c04ac098cf88594903744
      Size/MD5 checksum:    48892 7af6aaca5c209bc9035be7d70784e9cb
      Size/MD5 checksum:  7549932 60e9a964ad08a8da5b2ea3f9102bead7
      Size/MD5 checksum:  7373492 bcf1f20eb6e6a973348a70628b1f4c4c

arm architecture (ARM)

      Size/MD5 checksum:  1749396 bdd8b56e6fcd449a95fa84557be2a36c
      Size/MD5 checksum:    48944 a1eefc9dc4f1b06dc273e3a9e8bb15b0
      Size/MD5 checksum: 25391008 274f4ba0bc48cbaad699d13f18d890ed
      Size/MD5 checksum:  7209164 361da5227a960f85c4ff9e7940e0c48c
      Size/MD5 checksum:  6929398 7dd6fa8d51380dbd14733d9a412a22ed

hppa architecture (HP PA RISC)

      Size/MD5 checksum:  8054922 1f896596ed2155bbb303170d5c58c52b
      Size/MD5 checksum:    48944 a588f3af5d0ff21ab4b40c81d1e6fc6c
      Size/MD5 checksum: 27197414 0d83d649dc99199513a1db73707f24f6
      Size/MD5 checksum:  1923360 1cb59886260894b0d22f2a51a192de50
      Size/MD5 checksum:  8008532 93aaf8278a886dcba497aa9e2bb6293e

i386 architecture (Intel ia32)

      Size/MD5 checksum:  1795330 545b9a1f38f32aabacec4a5269e0aef4
      Size/MD5 checksum:  7193656 1755e4d988b95b31afdac22af89b8336
      Size/MD5 checksum:    48944 6f8c556248dfb80e251bb4985b266a8a
      Size/MD5 checksum: 25359554 03d2005576588e2c02274fcffe42d955
      Size/MD5 checksum:  6976660 97d2e827f13ed9d35fce8467ca2b9efa

ia64 architecture (Intel ia64)

      Size/MD5 checksum:  9740464 ab1ab10891736c731e456a3b177a2312
      Size/MD5 checksum: 10344966 66e944be1b43f145243c27f57850d196
      Size/MD5 checksum:    48896 57f5afd3c27d68ba80a8739c5604095c
      Size/MD5 checksum: 30405338 3dda87502fa124a4a5d5005c81e738c4
      Size/MD5 checksum:  2116718 da6a3ae401c77062478f2fd020435d29

mipsel architecture (MIPS (Little Endian))

      Size/MD5 checksum: 25849668 0c94d38f290a9ed10a2edbe5ea3e741b
      Size/MD5 checksum:    48902 0c47a91385eef6956f214bfb22ed1b48
      Size/MD5 checksum:  7643768 e2b5b36f68cef57f9311723496b159b0
      Size/MD5 checksum:  7565666 08d656eaee1e93290058e63f90b11fd6
      Size/MD5 checksum:  1790838 5a763673b2f69c5c7b99093f83dca05e

powerpc architecture (PowerPC)

      Size/MD5 checksum:  7526456 177c37f69f3b0ac0b0190a1f6b30974d
      Size/MD5 checksum:    48952 4043f7b2094834103a474398a8662dcc
      Size/MD5 checksum: 26316574 fb4938e1a2d923c61e4a7d022fd09453
      Size/MD5 checksum:  7572330 24a85e6c00e7706cd0d86be06aa2b4df
      Size/MD5 checksum:  1832552 fe2b6a7aa7655f4dd3533256e1d6c1cd

sparc architecture (Sun SPARC/UltraSPARC)

      Size/MD5 checksum:  7016770 3e210b7a8f29c3249debffb84925cccb
      Size/MD5 checksum: 25549876 c93a3c01ad19a0c1ee67f2735d27ddf2
      Size/MD5 checksum:    48892 17f1009dbde6d24660ece46896a4e3c7
      Size/MD5 checksum:  7162030 5dcf1cdc5747381a87d983ffd785131e
      Size/MD5 checksum:  1798414 c2a754cb9699ed08630984d32a0e0681

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

      Size/MD5 checksum:     1746 e2f47c4a8b255f1ecebfca3416a9bd06
      Size/MD5 checksum: 17946664 6fae978908ad5eb790fa3f24f16dadba
      Size/MD5 checksum:   379840 3383e2cd99f1a1108d9afc942ada9234

Architecture independent packages:

      Size/MD5 checksum:    61638 f95c22084e5fe701749eb775dcb72fca
      Size/MD5 checksum:    55124 4ace4e9ed13e673babf77e095f732fc3
      Size/MD5 checksum:    52928 9c459e3fd6a4d26d61ebd53c6ff59fc2

alpha architecture (DEC Alpha)

      Size/MD5 checksum:  2017374 9cfa50e93ff4eb076c4b279db28590b2
      Size/MD5 checksum: 28323504 497b285f781bab661e872958db2706fa
      Size/MD5 checksum:  8921890 69a8ae8d4b8c65ba91ccd0f85c974eb3
      Size/MD5 checksum:  9069206 210e61b74049dd98ac2ac22d35cf87bf

amd64 architecture (AMD x86_64 (AMD64))

      Size/MD5 checksum: 27159426 5969018772991a4d3ec674a892f3eca3
      Size/MD5 checksum:  8207634 de959e4ec57baeb625a1b787957f1b4e
      Size/MD5 checksum:  7586020 5c3999c91d005b454e2b186c57d05532
      Size/MD5 checksum:  1905900 16f42105a813df0dc3ff86310bd617db

armel architecture (ARM EABI)

      Size/MD5 checksum: 26217720 8ac12229994f083d8d0fe61e7b21447c
      Size/MD5 checksum:  7255210 1411c1f593184806f334c5115d5e5b1e
      Size/MD5 checksum:  1783326 4939777b25fdcf7d2dc5512cfe79e45a
      Size/MD5 checksum:  7647988 0b5878b88bbbdccb50191c1624c9430e

hppa architecture (HP PA RISC)

      Size/MD5 checksum:  8429602 dd8e26cc1d2dc822570645ea76bb8c8e
      Size/MD5 checksum: 27882774 27f249a50e587c912e9c981257971c07
      Size/MD5 checksum:  8167562 758f37139ed34abcb8c6b73f481e7883
      Size/MD5 checksum:  1959060 6991ac7e53bc11c32f72a2fddb4bc7e1

i386 architecture (Intel ia32)

      Size/MD5 checksum:  7200822 2e2aaa0abb27d2704b40595faac5b483
      Size/MD5 checksum:  1860538 f50bcc91b4aa22b2861cd9e7d672aa16
      Size/MD5 checksum: 26654932 0bbb282a6496724b9113e84bb3af8d58
      Size/MD5 checksum:  7785150 d0feb6f30b7aa4a8225ffd3e3fcb536f

ia64 architecture (Intel ia64)

      Size/MD5 checksum:  2186408 287a20525b59ac1fd1f0164dabc01fde
      Size/MD5 checksum:  9933436 edd18fc5e20ed97d9b42b64427dde5a4
      Size/MD5 checksum: 10914030 9bd4e889ddf9d3794629bf3bd644e28d
      Size/MD5 checksum: 31432284 5d78f5b72f7e105598c2ff77d3336986

mipsel architecture (MIPS (Little Endian))

      Size/MD5 checksum:  7775656 b773580d6eb7f3c270394ae8bd46eb85
      Size/MD5 checksum:  7721124 346332bf620a57af88f1495758b617fb
      Size/MD5 checksum:  1810420 82c04ce1c097c08c17fff616a4507aa6
      Size/MD5 checksum: 26332894 7dcba45bd26831928b7a7dc989ece59b

powerpc architecture (PowerPC)

      Size/MD5 checksum:  1917890 a8181910ac284e74b82ac1f5bd0bf4af
      Size/MD5 checksum:  7615402 f57057aab219c296febad2b1dbd71292
      Size/MD5 checksum: 27312266 57d56f008e598595c89a87dd8fcfcd85
      Size/MD5 checksum:  8161690 96b710801fade82a7a0d2cb11f5b1357

s390 architecture (IBM S/390)

      Size/MD5 checksum:  2031780 33ab4b2fb41707110c214ba7412e6b6d
      Size/MD5 checksum:  8227402 9af8be2781006662773b51cfaa348db6
      Size/MD5 checksum:  7698110 9e844e96ebac4a0256f219f7eb921b78
      Size/MD5 checksum: 28104580 4a0ea6408ca35135353c26e4504f9233

sparc architecture (Sun SPARC/UltraSPARC)

      Size/MD5 checksum: 26813192 43180d48e10662a3f2f1bdef087a1c18
      Size/MD5 checksum:  7137808 a00a7b49b780235f55d9dcb80bda12b0
      Size/MD5 checksum:  7755776 22c7fd28be510233e2da5d61e56c8762
      Size/MD5 checksum:  1869120 342fc5e565b995da31edcf71797bd40e


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp:  dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/