|
|
Family: Gentoo Local Security Checks --> Category: infos
[GLSA-200503-19] MySQL: Multiple vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
MySQL: Multiple vulnerabilities
Detailed Explanation for this Vulnerability Test
The remote host is affected by the vulnerability described in GLSA-200503-19
(MySQL: Multiple vulnerabilities)
MySQL fails to properly validate input for authenticated users with
INSERT and DELETE rights (CVE-2005-0709 and CVE-2005-0710).
Furthermore MySQL uses predictable filenames when creating temporary
files with CREATE TEMPORARY TABLE (CVE-2005-0711).
Impact
A possible hacker with INSERT and DELETE rights could exploit this to
manipulate the mysql table or accessing libc calls, potentially leading
to the execution of arbitrary code with the permissions of the user
running MySQL. A possible hacker with CREATE TEMPORARY TABLE rights could
exploit this to overwrite arbitrary files via a symlink attack.
Workaround
There is no known workaround at this time.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0709
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0711
Solution:
All MySQL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mysql-4.0.24"
Threat Level: Medium
Click HERE for more information and discussions on this network vulnerability scan.
|
