MySQL Forums
Forum List  »  Security

mysql-dfsg 4.0.24 needed, have 4.0.23-7 for CAN-2005-0709, CAN-2005-0710, CAN-2005-0711
Posted by: Rakesh Gupta
Date: March 24, 2005 04:52PM

Has anyone verified these issues mentioned below:
Has MySQL published any notes about these issues? We are using MySQL 4.0.20 and would like to let our users know about these issues using MySQL published reference.
Thanks

Name CAN-2005-0709
Description MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated byusing strcat, on_exit, and exit.
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0709

Name CAN-2005-0710
Description MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to bypass library path restrictions and execute arbitrary libraries by using INSERT INTO to modify the mysql.func table, which is processed by the udf_init function.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0710

Name CAN-2005-0711
Description MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable file names when creating temporary tables, which allows local users with CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via a symlink attack.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0711

Options: ReplyQuote


Subject
Views
Written By
Posted
mysql-dfsg 4.0.24 needed, have 4.0.23-7 for CAN-2005-0709, CAN-2005-0710, CAN-2005-0711
3774
March 24, 2005 04:52PM


Sorry, you can't reply to this topic. It has been closed.

Content reproduced on this site is the property of the respective copyright holders. It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.