MySQL COM_CHANGE_USER password buffer overflow
| mysql-comchangeuser-password-bo (10848) |  High Risk |
Description:
MySQL is vulnerable to a buffer overflow, caused by improper bounds checking of user passwords when using the COM_CHANGE_USER command. By sending a password of more than 16 characters using the COM_CHANGE_USER command, a remote or local attacker could overflow a buffer and cause the mysqld service to crash or execute arbitrary code on the system with elevated privileges.
Consequences:
Gain Access
Remedy:
Upgrade to the latest version of MySQL (3.23.54 or later), available from the MySQL Web site. See References.
For Turbolinux (MySQL):
Refer to TLSA-2007-16 for patch, upgrade, or suggested workaround information. See References.
For EnGarde Secure Linux Community Edition:
Upgrade to the latest MySQL package (3.23.36-1.0.20 or later), as listed in EnGarde Secure Linux Security Advisory 20021213-033. See References.
For Gentoo Linux:
Upgrade versions dev-db/mysql-3.23.53 and earlier, as listed in Gentoo Linux Security Announcement 200212-2.1. See References.
For OpenPKG:
Upgrade to the latest mysql package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2002.013 for more information. See References.
OpenPKG 1.0: 3.23.46-1.0.1 or later
OpenPKG 1.1: 3.23.52-1.1.1 or later
OpenPKG CURRENT: 3.23.54-20021212 or later
For Conectiva Linux:
Upgrade to the latest MySQL package, as listed below. Refer to Conectiva Linux Announcement CLSA-2002:555 for more information. See References.
Conectiva Linux 6.0: 3.23.36-14U60_3cl or later
Conectiva Linux 7.0: 3.23.36-14U70_3cl or later
Conectiva Linux 8.0: 3.23.46-4U80_2cl or later
For Debian GNU/Linux:
Upgrade to the latest mysql package, as listed below. Refer to DSA-212-1 for more information. See References.
Debian GNU/Linux 2.2 (potato): 3.22.32-6.3 or later
Debian GNU/Linux 3.0 (woody): 3.23.49-8.2 or later
For Mandrake Linux:
Upgrade to the latest MySQL package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:087: MySQL for more information. See References.
Linux-Mandrake 7.2 and Single Network Firewall 7.2: 3.23.31-1.3mdk or later
Mandrake Linux 8.0: 3.23.36-2.2mdk or later
Mandrake Linux 8.1: 3.23.41-5.2mdk or later
Mandrake Linux 8.2: 3.23.47-5.2mdk or later
Mandrake Linux 9.0: 3.23.52-1.2mdk or later
For Trustix Secure Linux 1.5:
Upgrade to the latest MySQL package (3.23.54a-1tr or later), as listed in Trustix Secure Linux Security Advisory #2002-0086 for more information. See References.
For Red Hat Linux:
Upgrade to the latest my SQL package, as listed below. Refer to RHSA-2002:288-22 for more information. See References.
Red Hat 7.0: mysql-3.23.54a-3.70 or later
Red Hat 7.1: mysql-3.23.54a-3.71 or later
Red Hat 7.2: mysql-3.23.54a-3.72 or later
Red Hat 7.3: mysql-3.23.54a-3.73 or later
Red Hat 8.0: mysql-3.23.54a-4 or later
For TurboLinux Server 6.5, Advanced Server 6 and TurboLinux 7 and 8 (Server and Workstation):
Upgrade to the latest version of MySQL (3.23.52-3 or later), as listed in TurboLinux Security Announcement TLSA-2003-7. See References.
For Immunix OS 7+:
Upgrade to the latest version of mysql (3.23.54a-3.70_imnx_1 or later), as listed in Immunix OS Security Advisory IMNX-2003-7+-008-01. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- Conectiva Linux Announcement CLSA-2002:555: Several Vulnerabilities.
- e-matters Security Advisory 04/2002: Multiple MySQL vulnerabilities .
- EnGarde Secure Linux Security Advisory ESA-20021213-033: Several MySQL vulnerabilities.. (From LinuxSecurity archive)
- Gentoo Linux Security Announcement 200212-2.1: remote DOS and arbitrary code execution.
- Immunix OS Security Advisory IMNX-2003-7+-008-01: mysql. (From LinuxSecurity archive)
- MySQL Web site: Downloads for the 3.23 version.
- Trustix Secure Linux Security Advisory #2002-0086: mysql -- Multiple issues.
- VulnWatch Mailing List, Tue Jan 21 2003 - 19:03:41 CST: Multiple MySQL bugs.
- BID-6375: MySQL COM_CHANGE_USER Password Memory Corruption Vulnerability
- CVE-2002-1375: The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long response.
- DSA-212: mysql -- multiple problems
- MDKSA-2002:087: Updated MySQL packages fix multiple vulnerabilities
- RHSA-2002-288: Updated MySQL packages fix various security issues
- RHSA-2002-289: mysql security update
- RHSA-2003-166: Updated MySQL packages fix vulnerabilities
- SUSE-SA:2003:003: mysql: remote command execution
Platforms Affected:
- Conectiva Linux 6.0
- Conectiva Linux 7.0
- Conectiva Linux 8.0
- Debian Debian Linux 2.2
- Debian Debian Linux 3.0
- EngardeLinux Secure Linux
- EngardeLinux Secure Professional
- FreeBSD FreeBSD
- Gentoo Linux
- Immunix Immunix OS 7+-beta
- MandrakeSoft Mandrake Linux 7.2
- MandrakeSoft Mandrake Linux 8.0
- MandrakeSoft Mandrake Linux 8.0 PPC
- MandrakeSoft Mandrake Linux 8.1
- MandrakeSoft Mandrake Linux 8.1 IA64
- MandrakeSoft Mandrake Linux 8.2
- MandrakeSoft Mandrake Linux 8.2 PPC
- MandrakeSoft Mandrake Linux 9.0
- MandrakeSoft Mandrake Single Network Firewall 7.2
- MySQL MySQL 3.22.26
- MySQL MySQL 3.22.27
- MySQL MySQL 3.22.28
- MySQL MySQL 3.22.29
- MySQL MySQL 3.22.30
- MySQL MySQL 3.22.32
- MySQL MySQL 3.23.10
- MySQL MySQL 3.23.2
- MySQL MySQL 3.23.23
- MySQL MySQL 3.23.24
- MySQL MySQL 3.23.25
- MySQL MySQL 3.23.26
- MySQL MySQL 3.23.27
- MySQL MySQL 3.23.28
- MySQL MySQL 3.23.29
- MySQL MySQL 3.23.3
- MySQL MySQL 3.23.30
- MySQL MySQL 3.23.31
- MySQL MySQL 3.23.34
- MySQL MySQL 3.23.36
- MySQL MySQL 3.23.37
- MySQL MySQL 3.23.38
- MySQL MySQL 3.23.39
- MySQL MySQL 3.23.4
- MySQL MySQL 3.23.40
- MySQL MySQL 3.23.41
- MySQL MySQL 3.23.42
- MySQL MySQL 3.23.43
- MySQL MySQL 3.23.44
- MySQL MySQL 3.23.45
- MySQL MySQL 3.23.46
- MySQL MySQL 3.23.47
- MySQL MySQL 3.23.48
- MySQL MySQL 3.23.49
- MySQL MySQL 3.23.5
- MySQL MySQL 3.23.50
- MySQL MySQL 3.23.51
- MySQL MySQL 3.23.52
- MySQL MySQL 3.23.53
- MySQL MySQL 3.23.53a
- MySQL MySQL 3.23.8
- MySQL MySQL 3.23.9
- MySQL MySQL 4.0.0
- MySQL MySQL 4.0.1
- MySQL MySQL 4.0.2
- MySQL MySQL 4.0.3
- MySQL MySQL 4.0.5A
- Novell SuSE Linux Enterprise Server 7.0
- Novell UnitedLinux 1.0
- OpenPKG OpenPKG 1.0
- OpenPKG OpenPKG 1.1
- OpenPKG OpenPKG CURRENT
- RedHat Enterprise Linux 2.1 AS
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.1 for iSeries
- RedHat Linux 7.1 for pSeries
- RedHat Linux 7.2
- RedHat Linux 7.3
- RedHat Linux 8.0
- RedHat Linux Advanced Workstation 2.1 Itanium
- SuSE Linux Enterprise Server 8
- SUSE SuSE Linux 7.1
- SUSE SuSE Linux 7.2
- SUSE SuSE Linux 7.3
- SUSE SuSE Linux 8.0
- SUSE SuSE Linux 8.1
- SuSE SuSE Linux Connectivity Server
- SuSE SuSE Linux Office Server
- Trustix Secure Linux 1.5
- Turbolinux Turbolinux 10 Desktop
- Turbolinux Turbolinux 10 F...
- Turbolinux Turbolinux 10 Server
- Turbolinux Turbolinux 10 Server x64 Ed
- Turbolinux Turbolinux 7 Server
- Turbolinux Turbolinux 7 Workstation
- Turbolinux Turbolinux 8 Server
- Turbolinux Turbolinux 8 Workstation
- Turbolinux Turbolinux FUJI
- Turbolinux Turbolinux Home
- Turbolinux Turbolinux Advanced Server 6
- Turbolinux Turbolinux Appliance Server 2.0
- Turbolinux Turbolinux Server 6.1
- Turbolinux Turbolinux Server 6.5
Reported:
Dec 12, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net