MySQL COM_CHANGE_USER password buffer overflow

mysql-comchangeuser-password-bo (10848) The risk level is classified as HighHigh Risk

Description:

MySQL is vulnerable to a buffer overflow, caused by improper bounds checking of user passwords when using the COM_CHANGE_USER command. By sending a password of more than 16 characters using the COM_CHANGE_USER command, a remote or local attacker could overflow a buffer and cause the mysqld service to crash or execute arbitrary code on the system with elevated privileges.

Platforms Affected:

  • Conectiva, Linux 6.0
  • Conectiva, Linux 7.0
  • Conectiva, Linux 8.0
  • Debian, Debian Linux 2.2
  • Debian, Debian Linux 3.0
  • EngardeLinux, Secure Linux
  • EngardeLinux, Secure Professional
  • FreeBSD, FreeBSD
  • Gentoo, Linux
  • Immunix, Immunix OS 7+-beta
  • MandrakeSoft, Mandrake Linux 7.2
  • MandrakeSoft, Mandrake Linux 8.0
  • MandrakeSoft, Mandrake Linux 8.0 PPC
  • MandrakeSoft, Mandrake Linux 8.1
  • MandrakeSoft, Mandrake Linux 8.1 IA64
  • MandrakeSoft, Mandrake Linux 8.2 PPC
  • MandrakeSoft, Mandrake Linux 8.2
  • MandrakeSoft, Mandrake Linux 9.0
  • MandrakeSoft, Mandrake Single Network Firewall 7.2
  • MySQL, MySQL 3.22.26
  • MySQL, MySQL 3.22.27
  • MySQL, MySQL 3.22.28
  • MySQL, MySQL 3.22.29
  • MySQL, MySQL 3.22.30
  • MySQL, MySQL 3.22.32
  • MySQL, MySQL 3.23.10
  • MySQL, MySQL 3.23.2
  • MySQL, MySQL 3.23.23
  • MySQL, MySQL 3.23.24
  • MySQL, MySQL 3.23.25
  • MySQL, MySQL 3.23.26
  • MySQL, MySQL 3.23.27
  • MySQL, MySQL 3.23.28
  • MySQL, MySQL 3.23.29
  • MySQL, MySQL 3.23.3
  • MySQL, MySQL 3.23.30
  • MySQL, MySQL 3.23.31
  • MySQL, MySQL 3.23.34
  • MySQL, MySQL 3.23.36
  • MySQL, MySQL 3.23.37
  • MySQL, MySQL 3.23.38
  • MySQL, MySQL 3.23.39
  • MySQL, MySQL 3.23.4
  • MySQL, MySQL 3.23.40
  • MySQL, MySQL 3.23.41
  • MySQL, MySQL 3.23.42
  • MySQL, MySQL 3.23.43
  • MySQL, MySQL 3.23.44
  • MySQL, MySQL 3.23.45
  • MySQL, MySQL 3.23.46
  • MySQL, MySQL 3.23.47
  • MySQL, MySQL 3.23.48
  • MySQL, MySQL 3.23.49
  • MySQL, MySQL 3.23.5
  • MySQL, MySQL 3.23.50
  • MySQL, MySQL 3.23.51
  • MySQL, MySQL 3.23.52
  • MySQL, MySQL 3.23.53
  • MySQL, MySQL 3.23.53a
  • MySQL, MySQL 3.23.8
  • MySQL, MySQL 3.23.9
  • MySQL, MySQL 4.0.0
  • MySQL, MySQL 4.0.1
  • MySQL, MySQL 4.0.2
  • MySQL, MySQL 4.0.3
  • MySQL, MySQL 4.0.5A
  • Novell, UnitedLinux 1.0
  • OpenPKG, OpenPKG 1.0
  • OpenPKG, OpenPKG 1.1
  • OpenPKG, OpenPKG CURRENT
  • RedHat, Enterprise Linux 2.1 AS
  • RedHat, Linux 7
  • RedHat, Linux 7.1
  • RedHat, Linux 7.1 for iSeries
  • RedHat, Linux 7.1 for pSeries
  • RedHat, Linux 7.2
  • RedHat, Linux 7.3
  • RedHat, Linux 8.0
  • RedHat, Linux Advanced Workstation 2.1 Itanium
  • SuSE, Linux Enterprise Server 8
  • SuSE, SuSE Linux 7.1
  • SuSE, SuSE Linux 7.2
  • SuSE, SuSE Linux 7.3
  • SuSE, SuSE Linux 8.0
  • SuSE, SuSE Linux 8.1
  • SuSE, SuSE Linux Connectivity Server
  • SuSE, SuSE Linux Enterprise Server 7.0
  • SuSE, SuSE Linux Office Server
  • Trustix, Secure Linux 1.5
  • Turbolinux, Turbolinux 10 Desktop
  • Turbolinux, Turbolinux 10 F...
  • Turbolinux, Turbolinux 10 Server
  • Turbolinux, Turbolinux 10 Server x64 Ed
  • Turbolinux, Turbolinux 7 Server
  • Turbolinux, Turbolinux 7 Workstation
  • Turbolinux, Turbolinux 8 Server
  • Turbolinux, Turbolinux 8 Workstation
  • Turbolinux, Turbolinux FUJI
  • Turbolinux, Turbolinux Home
  • Turbolinux, Turbolinux Advanced Server 6
  • Turbolinux, Turbolinux Appliance Server 2.0
  • Turbolinux, Turbolinux Server 6.1
  • Turbolinux, Turbolinux Server 6.5

Remedy:

Upgrade to the latest version of MySQL (3.23.54 or later), available from the MySQL Web site. See References.

For Turbolinux (MySQL):
Refer to TLSA-2007-16 for patch, upgrade, or suggested workaround information. See References.

For EnGarde Secure Linux Community Edition:
Upgrade to the latest MySQL package (3.23.36-1.0.20 or later), as listed in EnGarde Secure Linux Security Advisory 20021213-033. See References.

For Gentoo Linux:
Upgrade versions dev-db/mysql-3.23.53 and earlier, as listed in Gentoo Linux Security Announcement 200212-2.1. See References.

For OpenPKG:
Upgrade to the latest mysql package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2002.013 for more information. See References.

OpenPKG 1.0: 3.23.46-1.0.1 or later
OpenPKG 1.1: 3.23.52-1.1.1 or later
OpenPKG CURRENT: 3.23.54-20021212 or later

For Conectiva Linux:
Upgrade to the latest MySQL package, as listed below. Refer to Conectiva Linux Announcement CLSA-2002:555 for more information. See References.

Conectiva Linux 6.0: 3.23.36-14U60_3cl or later
Conectiva Linux 7.0: 3.23.36-14U70_3cl or later
Conectiva Linux 8.0: 3.23.46-4U80_2cl or later

For Debian GNU/Linux:
Upgrade to the latest mysql package, as listed below. Refer to DSA-212-1 for more information. See References.

Debian GNU/Linux 2.2 (potato): 3.22.32-6.3 or later
Debian GNU/Linux 3.0 (woody): 3.23.49-8.2 or later

For Mandrake Linux:
Upgrade to the latest MySQL package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:087: MySQL for more information. See References. Linux-Mandrake 7.2 and Single Network Firewall 7.2: 3.23.31-1.3mdk or later
Mandrake Linux 8.0: 3.23.36-2.2mdk or later
Mandrake Linux 8.1: 3.23.41-5.2mdk or later
Mandrake Linux 8.2: 3.23.47-5.2mdk or later
Mandrake Linux 9.0: 3.23.52-1.2mdk or later

For Trustix Secure Linux 1.5:
Upgrade to the latest MySQL package (3.23.54a-1tr or later), as listed in Trustix Secure Linux Security Advisory #2002-0086 for more information. See References.

For Red Hat Linux:
Upgrade to the latest my SQL package, as listed below. Refer to RHSA-2002:288-22 for more information. See References.

Red Hat 7.0: mysql-3.23.54a-3.70 or later
Red Hat 7.1: mysql-3.23.54a-3.71 or later
Red Hat 7.2: mysql-3.23.54a-3.72 or later
Red Hat 7.3: mysql-3.23.54a-3.73 or later
Red Hat 8.0: mysql-3.23.54a-4 or later

For TurboLinux Server 6.5, Advanced Server 6 and TurboLinux 7 and 8 (Server and Workstation):
Upgrade to the latest version of MySQL (3.23.52-3 or later), as listed in TurboLinux Security Announcement TLSA-2003-7. See References.

For Immunix OS 7+:
Upgrade to the latest version of mysql (3.23.54a-3.70_imnx_1 or later), as listed in Immunix OS Security Advisory IMNX-2003-7+-008-01. See References.

For other distributions:
Contact your vendor for upgrade or patch information.

Consequences:

Gain Access

References:

Reported:

Dec 12, 2002

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page