Re: [Security-Discuss] Re: [Security Announce] MDKSA-2005:036 - Updated MySQL packages fix temporary file vulnerability

"Bill Moritz" <ego-iuGwUo7LVuOt/[email protected]>
Newsgroups gmane.linux.mandrake.security.general
Message-ID <[email protected]> 
So you are saying that 9.2 is no longer being supported?  Will a patch be 
coming out for 9.2?

> 
> > Did this vulnerability not affect 9.2?
> 
> Sure, but it's a perl script and 9.2 is in it's last days of life. 
>  We  need to weigh the pros and cons of updating things like this 
> for  packages that are in second-stage support.  If you are really 
>  concerned, grab one of the updated packages for the other platforms,
>   yank out the mysqlaccess perl script, and copy it over the 
> existing  one.
> 
> > ---------- Original Message -----------
> > From: Mandrakelinux Security Team <[email protected]>
> > To: security-announce-J4tZAbal8pkzaQFa27Lw39BPR1lH4CV8@public.gmane.org
> > Sent: Thu, 10 Feb 2005 17:12:59 -0700
> > Subject: [Security Announce] MDKSA-2005:036 - Updated MySQL packages  
> > fix
> > temporary file vulnerability
> >
> >> ______________________________________________________________________ 
> >> _
> >>
> >>                  Mandrakelinux Security Update Advisory
> >>   
> >> ______________________________________________________________________ 
> >> _
> >>
> >>  Package name:           MySQL
> >>  Advisory ID:            MDKSA-2005:036
> >>  Date:                   February 10th, 2005
> >>
> >>  Affected versions:	 10.0, 10.1, Corporate 3.0,
> >> 			 Corporate Server 2.1
> >>   
> >> ______________________________________________________________________
> >>
> >>  Problem Description:
> >>
> >>  A temporary file vulnerability in the mysqlaccess script in MySQL
> >> was discovered by Javier Fernandez-Sanguino Pena.  This flaw could  
> >> allow
> >>  an unprivileged user to let root overwrite arbitrary files via a
> >>  symlink attack.  It could also be used to view the contents of a
> >>  temporary file which could contain sensitive information.
> >>
> >>  The updated packages have been patched to prevent these problems.
> >>   
> >> ______________________________________________________________________ 
> >> _
> >>
> >>  References:
> >>
> >>   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0004
> >>   
> >> ______________________________________________________________________
> >>
> >>  Updated Packages:
> >>
> >>  Mandrakelinux 10.0:
> >>  50574ec1c70d78d0b4f7da1bd7d7d380
> > 10.0/RPMS/libmysql12-4.0.18-1.3.100mdk.i586.rpm
> >>  25710d5c4844ca1d123944ac0861bc0f  10.0/RPMS/libmysql12-devel-4.0.18-
> >> 1.3.100mdk.i586.rpm 8c056d72fa1d02c231ed321bfa0108af
> >>  10.0/RPMS/libqt3-mysql-3.2.3-19.6.100mdk.i586.rpm
> >> 94dcd13a633ef96a31b0f7da452afed1   
> >> 10.0/RPMS/MySQL-4.0.18-1.3.100mdk.i586.rpm
> >>  8df8f4a9d6cdce677d630ac134081898
> > 10.0/RPMS/MySQL-Max-4.0.18-1.3.100mdk.i586.rpm
> >>  bbe03440aa22bdf38204607f290915f8
> > 10.0/RPMS/MySQL-bench-4.0.18-1.3.100mdk.i586.rpm
> >>  64015efdb83f79c9a1fbedce63ea1f78
> > 10.0/RPMS/MySQL-client-4.0.18-1.3.100mdk.i586.rpm
> >>  5481c9bbc5daf2632c36f6dc7d2521c0
> > 10.0/RPMS/MySQL-common-4.0.18-1.3.100mdk.i586.rpm
> >>  2f8f209e44f7fbe18395e6e815e8cc5b   
> >> 10.0/SRPMS/MySQL-4.0.18-1.3.100mdk.src.rpm
> >>
> >>  Mandrakelinux 10.0/AMD64:
> >>  38bc4a1e8a79ec174569dfdfa98f022d  amd64/10.0/RPMS/lib64mysql12-
> >> 4.0.18-1.3.100mdk.amd64.rpm 6c3eea8562548a88e80d98c40af4bc68
> >>  amd64/10.0/RPMS/lib64mysql12-devel-4.0.18-1.3.100mdk.amd64.rpm
> >> 48feba0f77d5ead04e2226f50595494d  amd64/10.0/RPMS/lib64qt3-mysql-
> >> 3.2.3-19.6.100mdk.amd64.rpm 7bcddb4ae89e5f1934f272a4c4910dbe
> >>  amd64/10.0/RPMS/MySQL-4.0.18-1.3.100mdk.amd64.rpm
> >> c503b7cefabdfa0c49b658037190c6c5
> > amd64/10.0/RPMS/MySQL-Max-4.0.18-1.3.100mdk.amd64.rpm
> >>  3815a6a61e37a70e63c3794c6d4ab807  amd64/10.0/RPMS/MySQL-bench-
> >> 4.0.18-1.3.100mdk.amd64.rpm aaebba0d883e9abbb2bfa58b19b1a57e
> >>  amd64/10.0/RPMS/MySQL-client-4.0.18-1.3.100mdk.amd64.rpm
> >> 353006ae3541483c666416679841c1f6  amd64/10.0/RPMS/MySQL-common-
> >> 4.0.18-1.3.100mdk.amd64.rpm 2f8f209e44f7fbe18395e6e815e8cc5b
> >>  amd64/10.0/SRPMS/MySQL-4.0.18-1.3.100mdk.src.rpm
> >>
> >>  Mandrakelinux 10.1:
> >>  bd3a35f3ba7440aa79f3940f20422b19
> > 10.1/RPMS/libmysql12-4.0.20-3.2.101mdk.i586.rpm
> >>  c3fd2f49a144ec27d8bad808a89cbb31  10.1/RPMS/libmysql12-devel-4.0.20-
> >> 3.2.101mdk.i586.rpm 3e2967952b1ddaa05561bf17b88fe24d
> >>  10.1/RPMS/libqt3-mysql-3.3.3-27.1.101mdk.i586.rpm
> >> f6b68d795599ec5a51b2c3c5cf3ada86   
> >> 10.1/RPMS/MySQL-4.0.20-3.2.101mdk.i586.rpm
> >>  514e962fbfb48e2d6e18baf8c6ad86b8
> > 10.1/RPMS/MySQL-Max-4.0.20-3.2.101mdk.i586.rpm
> >>  71624f3454fa8892b123104e1e9e7260
> > 10.1/RPMS/MySQL-bench-4.0.20-3.2.101mdk.i586.rpm
> >>  06fde75abed6b50838161eb95e375135
> > 10.1/RPMS/MySQL-client-4.0.20-3.2.101mdk.i586.rpm
> >>  fd3f8ed0bea7dee2e20fdf09a26c8715
> > 10.1/RPMS/MySQL-common-4.0.20-3.2.101mdk.i586.rpm
> >>  195735730d0535bef4dbe1fbb5c5cec7   
> >> 10.1/SRPMS/MySQL-4.0.20-3.2.101mdk.src.rpm
> >>
> >>  Mandrakelinux 10.1/X86_64:
> >>  841beab56f637c1148348685b39daf6f  x86_64/10.1/RPMS/lib64mysql12-
> >> 4.0.20-3.2.101mdk.x86_64.rpm 7aa4b9a407252d5a333cd25b2f11d39d
> >> x86_64/10.1/RPMS/lib64mysql12-devel-4.0.20-3.2.101mdk.x86_64.rpm
> >> ec4bb6dd0693f48a5960d30d48496839  x86_64/10.1/RPMS/lib64qt3-mysql-
> >> 3.3.3-27.1.101mdk.x86_64.rpm 3e2967952b1ddaa05561bf17b88fe24d
> >> x86_64/10.1/RPMS/libqt3-mysql-3.3.3-27.1.101mdk.i586.rpm
> >> 4683c29eac58dfea8c5d2d0aa7afc5e7
> > x86_64/10.1/RPMS/MySQL-4.0.20-3.2.101mdk.x86_64.rpm
> >>  31a8ca40e7da9f3b311bff981c3f5614  x86_64/10.1/RPMS/MySQL-Max-4.0.20-
> >> 3.2.101mdk.x86_64.rpm 2783b732a61d2eb87422daf0f18913b7
> >>  x86_64/10.1/RPMS/MySQL-bench-4.0.20-3.2.101mdk.x86_64.rpm
> >> f034044d8fda605eeba6db49da02c4c4  x86_64/10.1/RPMS/MySQL-client-
> >> 4.0.20-3.2.101mdk.x86_64.rpm ef4ce84d6cc648cf3e3cc938bafa8918
> >> x86_64/10.1/RPMS/MySQL-common-4.0.20-3.2.101mdk.x86_64.rpm
> >> 195735730d0535bef4dbe1fbb5c5cec7
> > x86_64/10.1/SRPMS/MySQL-4.0.20-3.2.101mdk.src.rpm
> >>
> >>  Corporate Server 2.1:
> >>  f4cd6b3d833a0a5d190b7d5defd6f18a  corporate/2.1/RPMS/libmysql10-
> >> 3.23.56-1.7.C21mdk.i586.rpm 1e2afd78697dfe26bfc9f5327f2f3108
> >>  corporate/2.1/RPMS/libmysql10-devel-3.23.56-1.7.C21mdk.i586.rpm
> >> a6f2168c5faffff7872ba6a5c4bc2dd2
> > corporate/2.1/RPMS/MySQL-3.23.56-1.7.C21mdk.i586.rpm
> >>  7f41d3536345a283812301a9b1416616  corporate/2.1/RPMS/MySQL-Max-
> >> 3.23.56-1.7.C21mdk.i586.rpm c8632bb5f0f31862aa764efe8aedab19
> >>  corporate/2.1/RPMS/MySQL-bench-3.23.56-1.7.C21mdk.i586.rpm
> >> 81c7febbb3be7b9c2c6f8eba26f6b040  corporate/2.1/RPMS/MySQL-client-
> >> 3.23.56-1.7.C21mdk.i586.rpm fbb22ec4f0087ea2df640f2e99786334
> >>  corporate/2.1/SRPMS/MySQL-3.23.56-1.7.C21mdk.src.rpm
> >>
> >>  Corporate Server 2.1/X86_64:
> >>  d1c474ac0d94e181d9955f33843ea1e5
> >> x86_64/corporate/2.1/RPMS/libmysql10-3.23.56-1.7.C21mdk.x86_64.rpm
> >> 6180ac0c3820243fc97191fc0e388618
> >>   
> >> x86_64/corporate/2.1/RPMS/libmysql10-devel-3.23.56 
> >> -1.7.C21mdk.x86_64.rpm
> >>  94629c4d41e9e5b041fd87a10f4626c6  x86_64/corporate/2.1/RPMS/MySQL-
> >> 3.23.56-1.7.C21mdk.x86_64.rpm 7c6e305fbbd13bda3ca09175931452b0
> >>  x86_64/corporate/2.1/RPMS/MySQL-Max-3.23.56-1.7.C21mdk.x86_64.rpm
> >> 4a5697b1822bae029b07e2f1d1907086  x86_64/corporate/2.1/RPMS/MySQL-
> >> bench-3.23.56-1.7.C21mdk.x86_64.rpm 66c8261cd44333d3457331fe65acb8d5
> >>  x86_64/corporate/2.1/RPMS/MySQL-client-3.23.56-
> >> 1.7.C21mdk.x86_64.rpm fbb22ec4f0087ea2df640f2e99786334
> >>  x86_64/corporate/2.1/SRPMS/MySQL-3.23.56-1.7.C21mdk.src.rpm
> >>
> >>  Corporate 3.0:
> >>  2f0f9a15805949a8b1c4f707b495065a  corporate/3.0/RPMS/libmysql12-
> >> 4.0.18-1.3.C30mdk.i586.rpm 96e08808e0abdb36562d9d1326f024fa
> >> corporate/3.0/RPMS/libmysql12-devel-4.0.18-1.3.C30mdk.i586.rpm
> >> e64e068fc62211319dbaa20574ec32cf
> > corporate/3.0/RPMS/MySQL-4.0.18-1.3.C30mdk.i586.rpm
> >>  18737baa96e918b9319b0f624e8279db  corporate/3.0/RPMS/MySQL-Max-
> >> 4.0.18-1.3.C30mdk.i586.rpm e002a2b1053995d8e18a43f1472154d6
> >> corporate/3.0/RPMS/MySQL-bench-4.0.18-1.3.C30mdk.i586.rpm
> >> e6ac405500f65b0ab00ea7238218cea7  corporate/3.0/RPMS/MySQL-client-
> >> 4.0.18-1.3.C30mdk.i586.rpm 35b216ccea7ac198c0e855e89789b0b9
> >> corporate/3.0/RPMS/MySQL-common-4.0.18-1.3.C30mdk.i586.rpm
> >> 7fc62e5799ef5dd03aa2cf973dec3220
> > corporate/3.0/SRPMS/MySQL-4.0.18-1.3.C30mdk.src.rpm
> >>
> >>  Corporate 3.0/X86_64:
> >>  ec3dd6d37697ef1832afd5abc07ef072
> >> x86_64/corporate/3.0/RPMS/lib64mysql12-4.0.18-1.3.C30mdk.x86_64.rpm
> >> 486940c54412a6a06ea2985fdd805cc3
> >>   
> >> x86_64/corporate/3.0/RPMS/lib64mysql12-devel-4.0.18 
> >> -1.3.C30mdk.x86_64.rpm
> >>  48feba0f77d5ead04e2226f50595494d
> >> x86_64/corporate/3.0/RPMS/lib64qt3-mysql-3.2.3-19.6.100mdk.amd64.rpm
> >> 3ca0207824ba315b9856e363831e8238  x86_64/corporate/3.0/RPMS/MySQL-
> >> 4.0.18-1.3.C30mdk.x86_64.rpm 64446e7f63df7df74426a47cf2de6625
> >> x86_64/corporate/3.0/RPMS/MySQL-Max-4.0.18-1.3.C30mdk.x86_64.rpm
> >> 390c3074eac1aac97b249979fa467741  x86_64/corporate/3.0/RPMS/MySQL-
> >> bench-4.0.18-1.3.C30mdk.x86_64.rpm f9b9bb7f21cdd8d53cbad39f37385143
> >> x86_64/corporate/3.0/RPMS/MySQL-client-4.0.18-1.3.C30mdk.x86_64.rpm
> >> 870eac0d47223dcf88ee24072e84dfc3  x86_64/corporate/3.0/RPMS/MySQL-
> >> common-4.0.18-1.3.C30mdk.x86_64.rpm 7fc62e5799ef5dd03aa2cf973dec3220
> >>  x86_64/corporate/3.0/SRPMS/MySQL-4.0.18-1.3.C30mdk.src.rpm
> > _______________________________________________________________________
> >>
> >>  To upgrade automatically use MandrakeUpdate or urpmi.  The  
> >> verification
> >>  of md5 checksums and GPG signatures is performed automatically for  
> >> you.
> >>
> >>  All packages are signed by Mandrakesoft for security.  You can
> >> obtain the GPG public key of the Mandrakelinux Security Team by  
> >> executing:
> >>
> >>   gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
> >>
> >>  You can view other update advisories for Mandrakelinux at:
> >>
> >>   http://www.mandrakesoft.com/security/advisories
> >>
> >>  If you want to report vulnerabilities, please contact
> >>
> >>   security_linux-mandrake.com
> >>
> >>  Type Bits/KeyID     Date       User ID
> >>  pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
> >>   <security linux-mandrake.com>
> >> -----BEGIN PGP SIGNATURE-----
> >> Version: GnuPG v1.2.4 (GNU/Linux)
> >>
> >> iD8DBQFCC/iLmqjQ0CJFipgRAmmVAKCB2tuw8rbCEFKObSVI1zY4d6jY3gCdGCc7
> >> MA8YkCnnBQD3DM3lOTBKTJg=
> >> =OZs0
> >> -----END PGP SIGNATURE-----
> > ------- End of Original Message -------
> >
> >
> > ____________________________________________________
> > Want to buy your Pack or Services from MandrakeSoft?
> > Go to http://www.mandrakestore.com
> > Join the Club : http://www.mandrakeclub.com
> > ____________________________________________________
> >
> 
> -- 
> "lynx -source http://linsec.ca/vdanen.asc | gpg --import"
> {FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}
------- End of Original Message -------
message.footer (text/plain, 239 B) 
____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.