mysql-dfsg 4.0.24 needed, have 4.0.23-7 for CAN-2005-0709, CAN-2005-0710, CAN-2005-0711
Has anyone verified these issues mentioned below:
Has MySQL published any notes about these issues? We are using MySQL 4.0.20 and would like to let our users know about these issues using MySQL published reference.
Thanks
Name CAN-2005-0709
Description MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated byusing strcat, on_exit, and exit.
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0709
Name CAN-2005-0710
Description MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to bypass library path restrictions and execute arbitrary libraries by using INSERT INTO to modify the mysql.func table, which is processed by the udf_init function.
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0710
Name CAN-2005-0711
Description MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable file names when creating temporary tables, which allows local users with CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via a symlink attack.
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0711