MySQL mysqlbug script symlink attack
| mysql-mysqlbug-symlink (15617) |  Medium Risk |
Description:
MySQL could allow a local attacker to launch a symlink attack. The mysqlbug script creates insecure temporary files, when the text editor is launched and the user exits the tool without making changes to the bug report. A local attacker could create a symbolic link for this file to an arbitrary file on the system, which could allow the attacker to overwrite arbitrary files on the system, with privileges of the mysqlbug user.
Consequences:
File Manipulation
Remedy:
Download the latest version of the mysqlbug script from the source repository, available from the MySQL Web site. See References.
For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest version of mysql (3.23.49-8.6 or later), as listed in DSA-483-1. See References.
For Mandrake Linux:
Upgrade to the latest mysql package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:034 : MySQL for more information. See References.
Mandrake Linux 9.1: 4.0.11a-5.2.91mdk or later
Mandrake Linux 9.2: 4.0.15-1.1.92mdk or later
Mandrake Linux 10.0: 4.0.18-1.1.100mdk or later
Mandrake Linux Corporate Server 2.1: 3.23.56-1.5.C21mdk or later
For Gentoo Linux:
Upgrade to the latest version of mysql (4.0.18-r2 or later), as listed in GLSA 200405-20. See References.
For Red Hat Linux:
Upgrade to the latest mysql package, as listed below. Refer to RHSA-2004:569-16 for more information. See References.
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), WS (v. 3), Desktop: .23.58-2.3.x86_64 or later
For Red Hat Linux:
Upgrade to the latest mysql package, as listed below. Refer to RHSA-2004:597-06 for more information. See References.
Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1), and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 3.23.58-1.72.1 or later
For OpenPKG:
Refer to OpenPKG Security Advisory OpenPKG-SA-2004.014 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, Wed Mar 24 2004 - 16:16:18 CST: mysqlbug tmpfile/symlink vulnerability..
- CIAC Information Bulletin O-123: Debian Security Advisory 483-1 MySQL.
- CIAC Information Bulletin P-018: Red Hat Update MySQL Packages Fix Security Issues and Bugs.
- GLSA 200405-20: Insecure Temporary File Creation In MySQL.
- MySQL Web site: 2.3.3 Installing from the Development Source Tree.
- BID-9976: MySQL Aborted Bug Report Insecure Temporary File Creation Vulnerability
- CVE-2004-0381: mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file.
- DSA-483: mysql -- insecure temporary file creation
- GLSA-200405-20: Insecure Temporary File Creation In MySQL
- MDKSA-2004:034: Updated MySQL packages fix temporary file insecurities
- OpenPKG-SA-2004.014: MySQL
- RHSA-2004-569: mysql security update
- RHSA-2004-597: mysql security update
Platforms Affected:
- Debian Debian Linux 3.0
- Gentoo Linux
- MandrakeSoft Mandrake Linux 10.0
- MandrakeSoft Mandrake Linux 9.1
- MandrakeSoft Mandrake Linux 9.1 PPC
- MandrakeSoft Mandrake Linux 9.2 AMD64
- MandrakeSoft Mandrake Linux 9.2
- MandrakeSoft Mandrake Linux Corporate Server 2.1
- MandrakeSoft Mandrake Linux Corporate Server 2.1 X86_64
- MySQL MySQL
- OpenPKG OpenPKG 1.3
- OpenPKG OpenPKG 2.0
- OpenPKG OpenPKG CURRENT
- RedHat Enterprise Linux 2.1 ES
- RedHat Enterprise Linux 2.1 WS
- RedHat Enterprise Linux 2.1 AS
- RedHat Enterprise Linux 2.1 AW
- RedHat Enterprise Linux 3 Desktop
- RedHat Enterprise Linux 3 AS
- RedHat Enterprise Linux 3 ES
- RedHat Enterprise Linux 3 WS
- RedHat Linux Advanced Workstation 2.1 Itanium
- Turbolinux Turbolinux 10 Desktop
- Turbolinux Turbolinux 10 F...
- Turbolinux Turbolinux 8 Server
- Turbolinux Turbolinux 8 Workstation
- Turbolinux Turbolinux Home
- Turbolinux Turbolinux Appliance Server 1.0 Hosting Ed
- Turbolinux Turbolinux Appliance Server 1.0 Workgroup Ed
Reported:
Mar 24, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net