MySQL COM_CHANGE_USER password buffer overflow
| mysql-comchangeuser-password-bo (10848) |  High Risk |
Description:
MySQL is vulnerable to a buffer overflow, caused by improper bounds checking of user passwords when using the COM_CHANGE_USER command. By sending a password of more than 16 characters using the COM_CHANGE_USER command, a remote or local attacker could overflow a buffer and cause the mysqld service to crash or execute arbitrary code on the system with elevated privileges.
Platforms Affected:
- Conectiva, Linux 6.0
- Conectiva, Linux 7.0
- Conectiva, Linux 8.0
- Debian, Debian Linux 2.2
- Debian, Debian Linux 3.0
- EngardeLinux, Secure Linux
- EngardeLinux, Secure Professional
- FreeBSD, FreeBSD
- Gentoo, Linux
- Immunix, Immunix OS 7+-beta
- MandrakeSoft, Mandrake Linux 7.2
- MandrakeSoft, Mandrake Linux 8.0
- MandrakeSoft, Mandrake Linux 8.0 PPC
- MandrakeSoft, Mandrake Linux 8.1
- MandrakeSoft, Mandrake Linux 8.1 IA64
- MandrakeSoft, Mandrake Linux 8.2 PPC
- MandrakeSoft, Mandrake Linux 8.2
- MandrakeSoft, Mandrake Linux 9.0
- MandrakeSoft, Mandrake Single Network Firewall 7.2
- MySQL, MySQL 3.22.26
- MySQL, MySQL 3.22.27
- MySQL, MySQL 3.22.28
- MySQL, MySQL 3.22.29
- MySQL, MySQL 3.22.30
- MySQL, MySQL 3.22.32
- MySQL, MySQL 3.23.10
- MySQL, MySQL 3.23.2
- MySQL, MySQL 3.23.23
- MySQL, MySQL 3.23.24
- MySQL, MySQL 3.23.25
- MySQL, MySQL 3.23.26
- MySQL, MySQL 3.23.27
- MySQL, MySQL 3.23.28
- MySQL, MySQL 3.23.29
- MySQL, MySQL 3.23.3
- MySQL, MySQL 3.23.30
- MySQL, MySQL 3.23.31
- MySQL, MySQL 3.23.34
- MySQL, MySQL 3.23.36
- MySQL, MySQL 3.23.37
- MySQL, MySQL 3.23.38
- MySQL, MySQL 3.23.39
- MySQL, MySQL 3.23.4
- MySQL, MySQL 3.23.40
- MySQL, MySQL 3.23.41
- MySQL, MySQL 3.23.42
- MySQL, MySQL 3.23.43
- MySQL, MySQL 3.23.44
- MySQL, MySQL 3.23.45
- MySQL, MySQL 3.23.46
- MySQL, MySQL 3.23.47
- MySQL, MySQL 3.23.48
- MySQL, MySQL 3.23.49
- MySQL, MySQL 3.23.5
- MySQL, MySQL 3.23.50
- MySQL, MySQL 3.23.51
- MySQL, MySQL 3.23.52
- MySQL, MySQL 3.23.53
- MySQL, MySQL 3.23.53a
- MySQL, MySQL 3.23.8
- MySQL, MySQL 3.23.9
- MySQL, MySQL 4.0.0
- MySQL, MySQL 4.0.1
- MySQL, MySQL 4.0.2
- MySQL, MySQL 4.0.3
- MySQL, MySQL 4.0.5A
- Novell, UnitedLinux 1.0
- OpenPKG, OpenPKG 1.0
- OpenPKG, OpenPKG 1.1
- OpenPKG, OpenPKG CURRENT
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Linux 7
- RedHat, Linux 7.1
- RedHat, Linux 7.1 for iSeries
- RedHat, Linux 7.1 for pSeries
- RedHat, Linux 7.2
- RedHat, Linux 7.3
- RedHat, Linux 8.0
- RedHat, Linux Advanced Workstation 2.1 Itanium
- SuSE, Linux Enterprise Server 8
- SuSE, SuSE Linux 7.1
- SuSE, SuSE Linux 7.2
- SuSE, SuSE Linux 7.3
- SuSE, SuSE Linux 8.0
- SuSE, SuSE Linux 8.1
- SuSE, SuSE Linux Connectivity Server
- SuSE, SuSE Linux Enterprise Server 7.0
- SuSE, SuSE Linux Office Server
- Trustix, Secure Linux 1.5
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux 10 Server x64 Ed
- Turbolinux, Turbolinux 7 Server
- Turbolinux, Turbolinux 7 Workstation
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux 8 Workstation
- Turbolinux, Turbolinux FUJI
- Turbolinux, Turbolinux Home
- Turbolinux, Turbolinux Advanced Server 6
- Turbolinux, Turbolinux Appliance Server 2.0
- Turbolinux, Turbolinux Server 6.1
- Turbolinux, Turbolinux Server 6.5
Remedy:
Upgrade to the latest version of MySQL (3.23.54 or later), available from the MySQL Web site. See References.
For Turbolinux (MySQL):
Refer to TLSA-2007-16 for patch, upgrade, or suggested workaround information. See References.
For EnGarde Secure Linux Community Edition:
Upgrade to the latest MySQL package (3.23.36-1.0.20 or later), as listed in EnGarde Secure Linux Security Advisory 20021213-033. See References.
For Gentoo Linux:
Upgrade versions dev-db/mysql-3.23.53 and earlier, as listed in Gentoo Linux Security Announcement 200212-2.1. See References.
For OpenPKG:
Upgrade to the latest mysql package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2002.013 for more information. See References.
OpenPKG 1.0: 3.23.46-1.0.1 or later
OpenPKG 1.1: 3.23.52-1.1.1 or later
OpenPKG CURRENT: 3.23.54-20021212 or later
For Conectiva Linux:
Upgrade to the latest MySQL package, as listed below. Refer to Conectiva Linux Announcement CLSA-2002:555 for more information. See References.
Conectiva Linux 6.0: 3.23.36-14U60_3cl or later
Conectiva Linux 7.0: 3.23.36-14U70_3cl or later
Conectiva Linux 8.0: 3.23.46-4U80_2cl or later
For Debian GNU/Linux:
Upgrade to the latest mysql package, as listed below. Refer to DSA-212-1 for more information. See References.
Debian GNU/Linux 2.2 (potato): 3.22.32-6.3 or later
Debian GNU/Linux 3.0 (woody): 3.23.49-8.2 or later
For Mandrake Linux:
Upgrade to the latest MySQL package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:087: MySQL for more information. See References.
Linux-Mandrake 7.2 and Single Network Firewall 7.2: 3.23.31-1.3mdk or later
Mandrake Linux 8.0: 3.23.36-2.2mdk or later
Mandrake Linux 8.1: 3.23.41-5.2mdk or later
Mandrake Linux 8.2: 3.23.47-5.2mdk or later
Mandrake Linux 9.0: 3.23.52-1.2mdk or later
For Trustix Secure Linux 1.5:
Upgrade to the latest MySQL package (3.23.54a-1tr or later), as listed in Trustix Secure Linux Security Advisory #2002-0086 for more information. See References.
For Red Hat Linux:
Upgrade to the latest my SQL package, as listed below. Refer to RHSA-2002:288-22 for more information. See References.
Red Hat 7.0: mysql-3.23.54a-3.70 or later
Red Hat 7.1: mysql-3.23.54a-3.71 or later
Red Hat 7.2: mysql-3.23.54a-3.72 or later
Red Hat 7.3: mysql-3.23.54a-3.73 or later
Red Hat 8.0: mysql-3.23.54a-4 or later
For TurboLinux Server 6.5, Advanced Server 6 and TurboLinux 7 and 8 (Server and Workstation):
Upgrade to the latest version of MySQL (3.23.52-3 or later), as listed in TurboLinux Security Announcement TLSA-2003-7. See References.
For Immunix OS 7+:
Upgrade to the latest version of mysql (3.23.54a-3.70_imnx_1 or later), as listed in Immunix OS Security Advisory IMNX-2003-7+-008-01. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- Conectiva Linux Announcement CLSA-2002:555, Several Vulnerabilities at http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000555.
- e-matters Security Advisory 04/2002, Multiple MySQL vulnerabilities at http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0106.html.
- EnGarde Secure Linux Security Advisory ESA-20021213-033, Several MySQL vulnerabilities. at http://www.linuxsecurity.com/content/view/104409/101/. (From LinuxSecurity archive)
- Gentoo Linux Security Announcement 200212-2.1, remote DOS and arbitrary code execution at http://archives.neohapsis.com/archives/bugtraq/2002-12/0138.html.
- Immunix OS Security Advisory IMNX-2003-7+-008-01, mysql at http://www.linuxsecurity.com/content/view/104896/105/. (From LinuxSecurity archive)
- MySQL Web site, Downloads for the 3.23 version at http://www.mysql.com/downloads/mysql-3.23.html.
- Trustix Secure Linux Security Advisory #2002-0086, mysql -- Multiple issues at http://www.trustix.net/errata/2002/0086/.
- VulnWatch Mailing List, Tue Jan 21 2003 - 19:03:41 CST, Multiple MySQL bugs at http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0031.html.
- BID-6375: MySQL COM_CHANGE_USER Password Memory Corruption Vulnerability
- CVE-2002-1375: The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long response.
- DSA-212: mysql -- multiple problems
- MDKSA-2002:087: Updated MySQL packages fix multiple vulnerabilities
- RHSA-2002-288: Updated MySQL packages fix various security issues
- RHSA-2002-289: mysql security update
- RHSA-2003-166: Updated MySQL packages fix vulnerabilities
- SUSE-SA:2003:003: mysql: remote command execution
Reported:
Dec 12, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net