MySQL open to attack

[InfoSec News <isn () c4i org>]

http://www.zdnet.com.au/newstech/security/story/0,2000024985,20270704,00.htm

By Patrick Gray
ZDNet Australia
16 December 2002
    
Several vulnerabilities have been found in the MySQL database system,
a light database package commonly used in Linux environments but which
runs also on Microsoft platforms, HP-Unix, Mac OS and more.

E-matters, a German company, released a security advisory after
discovering the security flaws. They have rated the vulnerabilities as
"Medium to Critical" in severity.

The security flaws discovered by the company range from Denial of
Service (DoS) problems to more serious issues.

"...one of the flaws can be used to bypass the MySQL password check or
to execute arbitrary code," the advisory said.

E-matters also found multiple vulnerabilities in the MySQL client
libraries, which "...could allow DoS attacks against or arbitrary code
execution within anything linked against libmysqlclient."

The vulnerabilities affect all versions prior to 3.23.53a and 4.0.5a.  
MySQL have released an updated "version 3" (3.23.54) that is immune to
the security bugs.

It is not known when an updated "version 4" MySQL will be released.

E-matters will not be releasing an exploit for the vulnerability.
 
 

-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.