Stay Secure with the Latest Linux Advisories

security advisorydebianmysql

Debian: DSA-1783 Critical: MySQL Remote Service Crash and XSS

Multiple vulnerabilities have been identified affecting MySQL, a relational database server, and its associated interactive client application. The Common Vulnerabilities and Exposures project identifies the following two problems: . - ------------------------------------------------------------------------ Debian Security Advisory DSA-1783 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Devin Carraway April 29, 2009 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : mysql-dfsg-5.0 Vulnerability : multiple Problem type : remote Debian-specific: no CVE Id(s) : CVE-2008-3963 CVE-2008-4456 Debian Bug : 498362 Multiple vulnerabilities have been identified affecting MySQL, a relational database server, and its associated interactive client application. The Common Vulnerabilities and Exposures project identifies the following two problems: CVE-2008-3963 Kay Roepke reported that the MySQL server would not properly handle an empty bit-string literal in an SQL statement, allowing an authenticated remote attacker to cause a denial of service (a crash) in mysqld. This issue affects the oldstable distribution (etch), but not the stable distribution (lenny). CVE-2008-4456 Thomas Henlich reported that the MySQL commandline client application did not encode HTML special characters when run in HTML output mode (that is, "mysql --html ..."). This could potentially lead to cross-site scripting or unintended script privilege escalation if the resulting output is viewed in a browser or incorporated into a web site. For the old stable distribution (etch), these problems have been fixed in version 5.0.32-7etch10. For the stable distribution (lenny), these problems have been fixed in version 5.0.51a-24+lenny1. We recommend that you upgrade your mysql-dfsg-5.0 packages. Upgrade instructions --------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian (oldstable) - ------------------ Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: Size/MD5 checksum: 316316 8b223eaabb58e59dd94eb0d4a8c92aea Size/MD5 checksum: 16439441 f99df050b0b847adf7702b44e79ac877 Size/MD5 checksum: 1119 dcbded9cba0e19d190fc2f77f134c550 Architecture independent packages: Size/MD5 checksum: 48356 e97c3e229d72842f1dd5b4ee7f1251ce Size/MD5 checksum: 46278 58c0f9871167c5cea7ef590300c1f615 Size/MD5 checksum: 55042 5e386582b3fd7d2b81f1ade654a00057 alpha architecture (DEC Alpha) Size/MD5 checksum: 8906160 a16ce759550234c3f2dd0951a6eb89b4 Size/MD5 checksum: 27247262 396f7d23a26b3811c1962556e4178a29 Size/MD5 checksum: 1947978 6dafad44578cfa7b49b923351c3bd103 Size/MD5 checksum: 48372 c0729575a598fb0265280781b7365834 Size/MD5 checksum: 8405666 3464e330822fb59efbeafacd2e40ede4 amd64 architecture (AMD x86_64 (AMD64)) Size/MD5 checksum: 1832088 357250a49039aa2ccaa55f25e8e3968e Size/MD5 checksum: 7381776 3638e4cd74fbbc929adb68d260c7a485 Size/MD5 checksum: 7548200 bdc8d651e463e0c4b7ed287b7ca1f43c Size/MD5 checksum: 48378 4160e8467f4590b4e9f9be20acdd778d Size/MD5 checksum: 25941038 081d5f54c7e3be08c7e8776e78e874a6 arm architecture (ARM) Size/MD5 checksum: 48434 b4f7a8ce2d9b4db432b0f8255751b313 Size/MD5 checksum: 7208068 0c231cb7c1f1c44a44632721e3686a9f Size/MD5 checksum: 1748598 9390f41e7016ad267e49ff35c42069a9 Size/MD5 checksum: 6931012 124a12ba4d32234f8a7eecefbc65ca1f Size/MD5 checksum: 25347856 7f872c65f8e45ca4b73e938a421a41fe hppa architecture (HP PA RISC) Size/MD5 checksum: 1922874 8af809572a8f0970dac614e56d0a2d99 Size/MD5 checksum: 8055770 e979e708351b181f66a87c3fc3e44c9a Size/MD5 checksum: 8005312 2b073a674f3bca0c3556cb25e8a62f10 Size/MD5 checksum: 48374 3a4f39c4a25745201127193910de9ee6 Size/MD5 checksum: 27179176 d66966c0e6f071fe5a3e81127d819e77 i386 architecture (Intel ia32) Size/MD5 checksum: 1794446 45b8d5185af57d225dfc11f00a29d5c8 Size/MD5 checksum: 6974340 5207734dfd742e027042a54c319272cc Size/MD5 checksum: 25369932 6ed97d08ede8b55091e283f28dcdac2c Size/MD5 checksum: 48428 edd5742646f29e51fcd12b5338daaad4 Size/MD5 checksum: 7194866 2547f45553ed1e039c467893b6ce10de ia64 architecture (Intel ia64) Size/MD5 checksum: 30404436 219e25b2ba8b1366e01dfaf3031f9e96 Size/MD5 checksum: 10342956 0ffe68b9ba56ca766c123beaeff77fef Size/MD5 checksum: 2115944 16a9e8364b4fb289a4899be8d183993a Size/MD5 checksum: 48374 0eb939131872361ff04780f636737687 Size/MD5 checksum: 9739652 ac79de3f43873ecb69c966b66beca3f1 mipsel architecture (MIPS (Little Endian)) Size/MD5 checksum: 1790138 294ac902b2dea86df6d24e602084964d Size/MD5 checksum: 7563528 734d80a47d138cd3ff9cb24593e1313b Size/MD5 checksum: 48378 90502bfe50ffef3ea1e7d70b741ac657 Size/MD5 checksum: 25848476 f96b6b16c3cb3af6ead2ff16a05c9023 Size/MD5 checksum: 7642696 82920ba66b11de45c84a75d090fb22e9 powerpc architecture (PowerPC) Size/MD5 checksum: 1833106 132dfeef44693f92d36b2051f5791d4f Size/MD5 checksum: 26169892 28732b89362d6101d176cefc10c29789 Size/MD5 checksum: 7513800 eb88731a88e1d4fbcef8cae2ab55f761 Size/MD5 checksum: 7575374 202cf90ca790e38d8ed2751e2fc4de1d Size/MD5 checksum: 48370 0de03d296210eb02dc71154d99a151da s390 architecture (IBM S/390) Size/MD5 checksum: 267664548456de04aab0751e04d972165b10c526 Size/MD5 checksum: 7415102 215aad68cadff5a34e94f8d5b66dc049 Size/MD5 checksum: 1952590 21551cd175cef4cb7997e36e84f9ae47 Size/MD5 checksum: 48370 450746f7967c185821d07c79017205c4 Size/MD5 checksum: 7508160 aa838310e8ce8feb2edf94c986ebe207 sparc architecture (Sun SPARC/UltraSPARC) Size/MD5 checksum: 25427664 882974f600f36ec287fe9211507f8f91 Size/MD5 checksum: 7153920 1bb209b696b198d154d36096973a0f57 Size/MD5 checksum: 7015286 654054bc87b497b9e689b83fed51f118 Size/MD5 checksum: 1798310 314ede7af23cfedf39c278a7285cfd1a Size/MD5 checksum: 48372 fd8fe1ce0cc9fc0cfc21e98126f0bc50 Debian (stable) - --------------- Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: Size/MD5 checksum: 341231 17ef8e070991c21b4a8ed27683e190ab Size/MD5 checksum: 1737 c66237a031cd9146316741285bca9766 Size/MD5 checksum: 17946664 6fae978908ad5eb790fa3f24f16dadba Architecture independent packages: Size/MD5 checksum: 54928 72442ba1cbd461b620193c9f12a4c1b1 Size/MD5 checksum: 60526 af7672b88c91abc7ad32eeb5aba5d899 Size/MD5 checksum: 52734 4b515755a8060b9c55847ac89d64dea2 alpha architecture (DEC Alpha) Size/MD5 checksum: 2017610 d7d73b71bde514bcddcc34ccb98179a3 Size/MD5 checksum: 9078508 052950781ae733b36d98778892be6996 Size/MD5 checksum: 28328874 0566b66e57a95d4a407f930624c4f62f Size/MD5 checksum: 8921072 6b4a65792a3e4a3a7898effdf3a88c1e amd64 architecture (AMD x86_64 (AMD64)) Size/MD5 checksum: 1905378 628959b2db2c6d53a946d95e1dcc6e05 Size/MD5 checksum: 7586410 91c0bd72028fcfada249b84efc33416a Size/MD5 checksum: 8207538 3aed01edd6bb309d65ae6b19309a1231 Size/MD5 checksum: 27157092 e48e558c67d6b9321e93a7fbe96f8138 arm architecture (ARM) Size/MD5 checksum: 7159776 4cbac4a908b11789c697a691e501d837 Size/MD5 checksum: 760611645c146f3a63b77c64e4d3fae1012eded Size/MD5 checksum: 26204724 446b1ec40a6e7a0e8f44fd63ee5c953a Size/MD5 checksum: 1782032 55d2b300101a8a2ceb864d11163dff15 armel architecture (ARM EABI) Size/MD5 checksum: 1779400 db26dc5db3cfb011576e191836e80342 Size/MD5 checksum: 7643540 01d16c6012e91fc2721cc56b01ae1e82 Size/MD5 checksum: 7250024 33dc67f1bbb58ee3b7976816b1a406c3 Size/MD5 checksum: 26214014 39846ba81302b2a50fdaafea01fcc980 hppa architecture (HP PA RISC) Size/MD5 checksum: 8167608 e3457b456652a8242cea25e194e68ea9 Size/MD5 checksum: 1959000 6a9e206daa9ff3c6420d795eb6217eaa Size/MD5 checksum: 8429344 f0050bae59f71b8a8b36928e769e2e68 Size/MD5 checksum: 27885032 bdf724ed1a3ae1e31d677b57daee4615 i386 architecture (Intel ia32) Size/MD5 checksum: 7777192 8ef21b2713791403c9fde6e8e7cc6f09 Size/MD5 checksum: 26677468 b3865ed165188cd9cd469d52673e5ba4 Size/MD5 checksum: 1859970 4eb77733e322db626fc1953e3ce0edab Size/MD5 checksum: 7197680 837eca5096e8288af8d7c87b1b2fc58b ia64 architecture (Intel ia64) Size/MD5 checksum: 10914682 0f8c038e2bab8117a925f069b79b8b5f Size/MD5 checksum: 9933502 e6cb7e17cccb8fc46ec3f26279b7bd0b Size/MD5 checksum: 2186212 683687adae52d9c99743301959013f33 Size/MD5 checksum: 31431258 3efd2ebba07a5dd225ce1725b7764c74 mips architecture (MIPS (Big Endian)) Size/MD5 checksum: 7838688 1fa47b0be2efa781d4baae56c949b4c1 Size/MD5 checksum: 1856112 b1329d54eb00d8fdcf688fae1e1ab1d5 Size/MD5 checksum: 26823126 b6788cc88c8a9ed89a84852cab1f8b78 Size/MD5 checksum: 7883724 075f6210bccdfde11084dcd6c38807db mipsel architecture (MIPS (Little Endian)) Size/MD5 checksum: 7720858 23e3c02af493edd6d6493af4bc7250c5 Size/MD5 checksum: 1809730 9a376aaa0289b086086cae0f2cd38b36 Size/MD5 checksum: 7775746 6ff81d634ba56f85d5fefeb206d956cb Size/MD5 checksum: 26342464 4f7d37a666c016c6ee1b4201452ce2f8 powerpc architecture (PowerPC) Size/MD5checksum: 1916268 0bc2ea2ef11e0643ddf1ff7baf2771d2 Size/MD5 checksum: 27153952 79af13c7ae97a1846cf47426add5db23 Size/MD5 checksum: 8152750 7eff89cf9541ba3e28a5bcf6ffef3668 Size/MD5 checksum: 7605402 395f7e23a4b9cb8511a0d19d8e1cce16 s390 architecture (IBM S/390) Size/MD5 checksum: 7697458 ccfcfe29bcd5184f41f430b699dba62c Size/MD5 checksum: 8226830 5cece6a80b492a781aadda362f58a730 Size/MD5 checksum: 28100750 4e83a4204f2e2ac7695a128695594df9 Size/MD5 checksum: 2031088 587d640431b7c9bb638d95cab27c1e8c sparc architecture (Sun SPARC/UltraSPARC) Size/MD5 checksum: 26831224 a298056134e8022219a0239b011e2833 Size/MD5 checksum: 7760640 d1e516164a185b5c8135f98bf72a2a5b Size/MD5 checksum: 1871516 877fa6da1c09343d77408a34cfec3929 Size/MD5 checksum: 7142942 cc29b305dd77e60f9b37da6a96c1028d These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb https://www.debian.org/security/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. Package info: `apt-cache show ' and https://www.debian.org/distrib/packages . Debian Security Advisory DSA-2397 highlights serious vulnerabilities in PostgreSQL. Update without delay to protect your data management system.. Debian Security, MySQL Upgrade, Remote Threat Management, Security Patch, Security Flaw Report. . Severity: Critical. LinuxSecurity.com Team

Apr 29, 2009 •Critical Debian