Ubuntu 12.10: 1658-1 Moderate: MySQL Arbitrary Code Execution Threat

ubuntu

December 10, 2012

MySQL could be made to run programs if it received specially crafted network traffic from an authenticated user.

Summary

MySQL could be made to run programs if it received specially crafted

network traffic from an authenticated user.

Software Description:

- mysql-5.5: MySQL database

- mysql-5.1: MySQL database

- mysql-dfsg-5.1: MySQL database

Details:

It was discovered that MySQL incorrectly handled certain long arguments. A

remote authenticated attacker could use this issue to possibly execute

arbitrary code.

Topics Covered

security advisory moderate MySQL arbitrary code execution Ubuntu network exploit

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  mysql-server-5.5                5.5.28-0ubuntu0.12.10.2

Ubuntu 12.04 LTS:
  mysql-server-5.5                5.5.28-0ubuntu0.12.04.3

Ubuntu 11.10:
  mysql-server-5.1                5.1.66-0ubuntu0.11.10.3

Ubuntu 10.04 LTS:
  mysql-server-5.1                5.1.66-0ubuntu0.10.04.3

In general, a standard system update will make all the necessary changes.