MySQL mysqld_multi script symlink attack
| mysql-mysqldmulti-symlink (15883) |  Medium Risk |
Description:
MySQL could allow a local attacker to launch a symlink attack. The mysqld_multi script creates insecure temporary files. A local attacker could create a symbolic link for this file to an arbitrary file on the system, which could allow the attacker to overwrite arbitrary files on the system, with privileges of the mysqld_multi user.
Consequences:
File Manipulation
Remedy:
For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest version of mysql (3.23.49-8.6 or later), as listed in DSA-483-1. See References.
For Mandrake Linux:
Upgrade to the latest mysql package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:034 : MySQL for more information. See References.
Mandrake Linux 9.1: 4.0.11a-5.2.91mdk or later
Mandrake Linux 9.2: 4.0.15-1.1.92mdk or later
Mandrake Linux 10.0: 4.0.18-1.1.100mdk or later
Mandrake Linux Corporate Server 2.1: 3.23.56-1.5.C21mdk or later
For Gentoo Linux:
Upgrade to the latest version of mysql (4.0.18-r2 or later), as listed in GLSA 200405-20. See References.
For Red Hat Linux:
Upgrade to the latest mysql package, as listed below. Refer to RHSA-2004:569-16 for more information. See References.
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), WS (v. 3), Desktop: .23.58-2.3.x86_64 or later
For Red Hat Linux:
Upgrade to the latest mysql package, as listed below. Refer to RHSA-2004:597-06 for more information. See References.
Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1), and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 3.23.58-1.72.1 or later
For OpenPKG:
Refer to OpenPKG Security Advisory OpenPKG-SA-2004.014 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, Wed Apr 14 2004 - 15:48:03 CDT: OpenPKG Security Advisory (mysql).
- CIAC Information Bulletin P-018: Red Hat Update MySQL Packages Fix Security Issues and Bugs.
- GLSA 200405-20: Insecure Temporary File Creation In MySQL.
- MySQL Web site: 2.3.3 Installing from the Development Source Tree.
- BID-10142: MySQL MYSQLD_Multi Insecure Temporary File Creation Vulnerability
- CVE-2004-0388: The mysqld_multi script in MySQL allows local users to overwrite arbitrary files via a symlink attack.
- DSA-483: mysql -- insecure temporary file creation
- GLSA-200405-20: Insecure Temporary File Creation In MySQL
- MDKSA-2004:034: Updated MySQL packages fix temporary file insecurities
- OpenPKG-SA-2004.014: MySQL
- OSVDB ID: 6421: MySQL mysqld_multi Symlink Arbitrary File Overwrite
- RHSA-2004-569: mysql security update
- RHSA-2004-597: mysql security update
- SA11223: MySQL "mysqlbug" Insecure Temporary File Creation Vulnerability
- SECTRACK ID: 1009784: MySQL `mysqld_multi` Temporary File Flaw Lets Local Users Overwrite Files
Platforms Affected:
- Debian Debian Linux 3.0
- Gentoo Linux
- MandrakeSoft Mandrake Linux 10.0
- MandrakeSoft Mandrake Linux 9.1
- MandrakeSoft Mandrake Linux 9.1 PPC
- MandrakeSoft Mandrake Linux 9.2 AMD64
- MandrakeSoft Mandrake Linux 9.2
- MandrakeSoft Mandrake Linux Corporate Server 2.1
- MandrakeSoft Mandrake Linux Corporate Server 2.1 X86_64
- MySQL MySQL
- OpenPKG OpenPKG 1.3
- OpenPKG OpenPKG 2.0
- OpenPKG OpenPKG CURRENT
- RedHat Enterprise Linux 2.1 ES
- RedHat Enterprise Linux 2.1 WS
- RedHat Enterprise Linux 2.1 AS
- RedHat Enterprise Linux 2.1 AW
- RedHat Enterprise Linux 3 Desktop
- RedHat Enterprise Linux 3 AS
- RedHat Enterprise Linux 3 ES
- RedHat Enterprise Linux 3 WS
- RedHat Linux Advanced Workstation 2.1 Itanium
- Turbolinux Turbolinux 10 Desktop
- Turbolinux Turbolinux 10 F...
- Turbolinux Turbolinux 8 Server
- Turbolinux Turbolinux 8 Workstation
- Turbolinux Turbolinux Home
- Turbolinux Turbolinux Appliance Server 1.0 Hosting Ed
- Turbolinux Turbolinux Appliance Server 1.0 Workgroup Ed
Reported:
Apr 14, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net