MYSQL Vulnerabilities

Linux Security:
Multiple vulnerabilities in MySQL
Topic:
Vulnerabilities in the mysql code can be used to crash the server or allow MySQL users to gain
privileges.

Problem Description:
There exist several vulnerabilities in the MySQL code:

1.A signed integer vulnerability in the COM_TABLE_DUMP package for MySQL

3.x to 3.23.53a allows remote attackers to cause a denial of service
(crash or hang) in mysqld by causing large negative integers to be provided
to a memcpy call.

2.The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a and 4.x to

4.0.5a allows a remote attacker to gain privileges via a brute force
attack using a one-character password, which causes MySQL to only compare
the provided password against the first character of the real
password.

3.The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a and 4.x to

4.0.5a allows remote attackers to execute arbitrary code via a long
response.

4.The MySQL client library (libmysqlclient) in MySQL 3.x to 3.23.53a and 4.x
to 4.0.5a does not properly verify length fields for certain responses
in the read_rows or read_one_row routines, which allows a malicious server
to cause a denial of service and possibly execute arbitrary
code.

MySQL has several vulnerabilities that can be used to execute arbitrary code or used in a denial-
of-service attack against the database server. These vulnerabilities include:
1.A buffer overflow in the code that handles COM_TABLE_DUMP can be used in a denial-of-service
attack. The buffer overflow is reported to affect Linux, FreeBSD, and MS Windows systems.
2.There is a flaw in the password authentication system in MySQL that makes it possible for an
attacker to authenticate as another user in no more than 32 attempts. The attacker must have a valid
account and can only attack accounts that have permission to log in from the host they are on. A local
user or a remote user in an environment that allows remote root logins can gain full access to all
databases. There is also a buffer overflow in the password authentication system.
3.The MySQL client is vulnerable to a buffer overflow when it reads rows from the database. This
vulnerability can be used in a denial-of-service attack against the client and may, under some
circumstances, be exploitable to execute code on the client machine.
It is recommended that users upgrade to MySQL 3.23.54 as soon as possible. Any software that is
linked against libmysql should also be upgraded or recompiled.
MySQL Multiple Code Execution and Security Bypass Vulnerabilities :

Rated as : High Risk

Multiple vulnerabilities have been identified in MySQL, which could be exploited by attackers or
malicious users to bypass security restrictions, disclose sensitive information, cause a denial of service
or compromise an affected system.

1.The first issue is caused by missing permission checks when handling BINLOG statements, which
could be exploited by any connected user to obtain elevated privileges.

2.The second vulnerability is caused by buffer overflow errors in yaSSL, which could be exploited by
remote attackers to crash a vulnerable server or execute arbitrary code.

3.The third issue is caused by an error when using RENAME TABLE. For additional information, see :
VUPEN/ADV-2007-4142

4.The fourth vulnerability is caused by an error in "ALTER VIEW". For additional information, see :
VUPEN/ADV-2007-4198

5.The fifth issue is caused by an error when using FEDERATED tables. For additional information, see
: VUPEN/ADV-2007-4198

6.The sixth vulnerability is caused by an error when creating a partitioned table using the DATA
DIRECTORY and INDEX DIRECTORY options, which could be exploited by malicious users to gain
privileges on other tables which have the same name as the partitioned table.

7.The seventh issue is caused by a buffer overflow error when displaying error message, which could
potentially be exploited by attackers to crash or potentially compromise an affected server.

MySQL IF Query Denial of Service Vulnerability :

Critical: Less critical
Software: MySQL 5.x
Description:
There is a vulnerability reported in MySQL, which can be exploited by malicious users to cause a DoS
(Denial of Service).
The vulnerability is caused due to an error when handling specially crafted IF queries, which can be
exploited to crash the server.
The vulnerability is reported in versions prior to 5.0.40.
MySQL Vulnerability with CVE ID's :

CVE-1999-1188
Description:
Mysqld in MySQL 3.21 creates log files with world-readable permissions, which allows
local users to obtain passwords for users who are added to the user database.
Severity: 3

CVE-2000-0045
Description:
MySQL allows local users to modify passwords for arbitrary MySQL users via the
GRANT privilege.
Severity: 3

CVE-2000-0148
Description:
MySQL 3.22 allows remote attackers to bypass password authentication and access a
database via a short check string.
Severity: 2

CVE-2000-0981
Description:
MySQL Database Engine uses a weak authentication method which leaks information
that could be used by a remote attacker to recover the password.
Severity: 3

CVE-2001-0407
Description:
Directory traversal vulnerability in MySQL before 3.23.36 allows local users to modify
arbitrary files and gain privileges by creating a database whose name starts with .. (dot dot).
Severity: 4

CVE-2001-1274
Description:
Buffer overflow in MySQL before 3.23.31 allows attackers to cause a denial of service
and possibly gain privileges.
Severity: 4 (possibly 3)

CVE-2001-1275
Description:
MySQL before 3.23.31 allows users with a MySQL account to use the SHOW GRANTS
command to obtain the encrypted administrator password from the mysql.user table and possibly gain
privileges via password cracking.
Severity: 4
CVE-2001-1453
Description:
Buffer overflow in libmysqlclient.so in MySQL 3.23.33 and earlier allows remote
attackers to execute arbitrary code via a long host parameter.
Severity: 6

CVE-2001-1454
Description:
Buffer overflow in MySQL before 3.23.33 allows remote attackers to execute arbitrary
code via a long drop database request.
Severity: 3

CVE-2002-0969
Description:
Buffer overflow in MySQL daemon (mysqld) before 3.23.50, and 4.0 beta before 4.02, on
the Win32 platform, allows local users to execute arbitrary code via a long "datadir" parameter in the
my.ini initialization file, whose permissions on Windows allow Full Control to the Everyone group.
Severity: 6

CVE-2002-1373
Description:
Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x
before 3.23.54 allows remote attackers to cause a denial of service (crash or hang) in mysqld by
causing large negative integers to be provided to a memcpy call.
Severity: 5

CVE-2002-1374
Description:
The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before
4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character
password, which causes MySQL to only compare the provided password against the first character of
the real password.
Severity: 2

CVE-2002-1375
Description:
The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6,
allows remote attackers to execute arbitrary code via a long response.
Severity: 3

CVE-2002-1376
Description:
Libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly
verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which
allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Severity: 6
CVE-2002-1809
Description:
The default configuration of the Windows binary release of MySQL 3.23.2 through
3.23.52 has a NULL root password, which could allow remote attackers to gain unauthorized root
access to the MySQL database.
Severity: 6

CVE-2002-1921
Description:
The default configuration of MySQL 3.20.32 through 3.23.52, when running on Windows,
does set the bind address to the loopback interface, which allows remote attackers to connect to the
database.
Severity: 6

CVE-2002-1923
Description:
The default configuration in MySQL 3.20.32 through 3.23.52, when running on Windows,
does not have logging enabled, which could allow remote attackers to conduct activities without
detection.

CVE-2003-0073
Description:
Double-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with
MySQL access to cause a denial of service (crash) via mysql_change_user.
Severity: 5

CVE-2003-0150
Description:
MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain
root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file
and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf.
Severity: 5

CVE-2003-0780
Description:
Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and
earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a
long Password field.
Severity: 4

CVE-2004-0381
Description:
mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on
the failed-mysql-bugreport Temporary file.
Severity: 6
CVE-2004-0388
Description:
The mysqld_multi script in MySQL allows local users to overwrite arbitrary files via a
symlink attack.
Severity: 6

CVE-2004-0457
Description:
The mysqlhotcopy script in mysql 4.0.20 and earlier, when using the scp method from the
mysql-server package, allows local users to overwrite arbitrary files via a symlink attack on temporary
files.
Severity: 6

CVE-2004-0627
Description:
The check_scramble_323 function in MySQL 4.1.x before 4.1.3, and 5.0, allows remote
attackers to bypass authentication via a zero-length scrambled string.
Severity: 6

CVE-2004-0628
Description:
Stack-based buffer overflow in MySQL 4.1.x before 4.1.3, and 5.0, allows remote
attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long scramble
string.
Severity: 6

CVE-2004-0835
Description:
MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1,
checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER
TABLE RENAME operation, which could allow attackers to conduct unauthorized activities.
Severity: 6

CVE-2004-0836
Description:
Buffer overflow in the mysql_real_connect function in MySQL 4.x before 4.0.21, and 3.x
before 3.23.49, allows remote attackers to cause a denial of service and possibly execute arbitrary code
via a malicious DNS server.
Severity: 6

CVE-2004-0837
Description:
MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows attackers to cause a denial of
service (crash or hang) via multiple threads that simultaneously alter MERGE table UNIONs.
Severity: 5
CVE-2004-0956
Description:
MySQL before 4.0.20 allows remote attackers to cause a denial of service (application
crash) via a MATCH AGAINST query with an opening double quote but no closing double quote.
Severity: 5

CVE-2004-0957
Description:
Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user has privileges for
a database whose name includes a "_" (underscore), grants privileges to other databases that have
similar names, which can allow the user to conduct unauthorized activities.
Severity: 7

CVE-2004-2149
Description:
Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta
and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders.
Severity: 6

CVE-2005-0004
Description:
The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before
5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary
files via a symlink attack on temporary files.
Severity: 6

CVE-2005-0709
Description:
MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with
INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access
libc calls, as demonstrated by using strcat, on_exit, and exit.
Severity: 4

CVE-2005-0710
Description:
MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with
INSERT and DELETE privileges to bypass library path restrictions and execute arbitrary libraries by
using INSERT INTO to modify the mysql.func table, which is processed by the udf_init function.
Severity: 4

CVE-2005-0711
Description:
MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable file names when
creating temporary tables, which allows local users with CREATE TEMPORARY TABLE privileges
to overwrite arbitrary files via a symlink attack.
Severity: 6
CVE-2005-0799
Description:
MySQL 4.1.9, and possibly earlier versions, allows remote attackers with certain
privileges to cause a denial of service (application crash) via a use command followed by an MS-DOS
device name such as (1) LPT1 or (2) PRN.
Severity: 5

CVE-2005-1636
Description:
Mysql_install_db in MySQL 4.1.x before 4.1.12 and 5.x up to 5.0.4 creates the
mysql_install_db.X file with a predictable filename and insecure permissions, which allows local users
to execute arbitrary SQL commands by modifying the file's contents.
Severity: 6

CVE-2005-1849
Description:
inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application
crash) via an invalid file that causes a large dynamic tree to be produced.
Severity: 3

CVE-2005-2096
Description:
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a
crafted compressed stream with an incomplete code description of a length greater than 1, which leads
to a buffer overflow, as demonstrated using a crafted PNG file.
Severity: 3

CVE-2005-2558
Description: Stack-based buffer overflow in the init_syms function in MySQL 4.0 before 4.0.25, 4.1
before 4.1.13, and 5.0 before 5.0.7-beta allows remote authenticated users who can create user-defined
functions to execute arbitrary code via a long function_name field.
Severity: 4

CVE-2005-2572
Description:
MySQL, when running on Windows, allows remote authenticated users with insert
privileges on the mysql.func table to cause a denial of service (server hang) and possibly execute
arbitrary code via (1) a request for a non-library file, which causes the Windows LoadLibraryEx
function to block, or (2) a request for a function in a library that has the XXX_deinit or XXX_init
functions defined but is not tailored for mySQL, such as jpeg1x32.dll and jpeg2x32.dll.
Severity: 4

CVE-2005-2573
Description:
The mysql_create_function function in sql_udf.cc for MySQL 4.0 before 4.0.25, 4.1 before
4.1.13, and 5.0 before 5.0.7-beta, when running on Windows, uses an incomplete blacklist in a
directory traversal check, which allows attackers to include arbitrary files via the backslash (\)
character.
Severity: 4

CVE-2006-0369
Description:
DISPUTED MySQL 5.0.18 allows local users with access to a VIEW to obtain sensitive
information via the "SELECT * FROM information_schema.views;" query, which returns the query
that created the VIEW. NOTE: this issue has been disputed by third parties, saying that the availability
of the schema is a normal and sometimes desired aspect of database access.
Severity: 7

CVE-2006-0903
Description:
MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL
queries that contain the NULL character, which are not properly handled by the mysql_real_query
function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states
that since mysql_query expects a null character, this is not an issue for mysql_query.
Severity: 6

CVE-2006-1516
Description:
The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to
4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username
without a trailing null byte, which causes a buffer over-read.
Severity: 6

CVE-2006-1517
Description:
sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20
allows remote attackers to obtain sensitive information via a COM_TABLE_DUMP request with an
incorrect packet length, which includes portions of memory in an error message.
Severity: 6

CVE-2006-1518
Description: Buffer overflow in the open_table function in sql_base.cc in MySQL 5.0.x up to 5.0.20
might allow remote attackers to execute arbitrary code via crafted COM_TABLE_DUMP packets with
invalid length values.
Severity: 4

CVE-2006-2753
Description:
SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows
context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in
character sets such as SJIS, BIG5, and GBK, which are not properly handled when the
mysql_real_escape function is used to escape the input.
Severity: 2
CVE-2006-3081
Description:
mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows
remote authorized users to cause a denial of service (crash) via a NULL second argument to the
str_to_date function.
Severity: 5

CVE-2006-3469
Description:
Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1
April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string
instead of a date as the first parameter to the date_format function, which is later used in a formatted
print call to display the error message.
Severity: 5

CVE-2006-3486
Description:
DISPUTED Off-by-one buffer overflow in the Instance_options::complete_initialization
function in instance_options.cc in the Instance Manager in MySQL before 5.0.23 and 5.1 before 5.1.12
might allow local users to cause a denial of service (application crash) via unspecified vectors, which
triggers the overflow when the convert_dirname function is called. NOTE: the vendor has disputed this
issue via e-mail to CVE, saying that it is only exploitable when the user has access to the configuration
file or the Instance Manager daemon. Due to intended functionality, this level of access would already
allow the user to disrupt program operation, so this does not cross security boundaries and is not a
vulnerability.
Severity: 6

CVE-2006-4031
Description:
MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table
through a previously created MERGE table, even after the user's privileges are revoked for the original
table, which might violate intended security policy.
Severity: 7

CVE-2006-4226
Description:
MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive
filesystems, allows remote authenticated users to create or access a database when the database name
differs only in case from a database for which they have permissions.
Severity: 4

CVE-2006-4227
Description:
MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the
security context of the routine's definer instead of the routine's caller, which allows remote
authenticated users to gain privileges through a routine that has been made available using GRANT
EXECUTE.
Severity: 4

CVE-2006-4380
Description:
MySQL before 4.1.13 allows local users to cause a denial of service (persistent replication
slave crash) via a query with multiupdate and subselects.
Severity: 5

CVE-2007-1420
Description:
MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash)
by performing information_schema table subselects and using ORDER BY to sort a single-row result,
which prevents certain structure elements from being initialized and triggers a NULL dereference in the
filesort function.
Severity: 5

CVE-2007-2583
Description:
The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before
5.1.18-beta, allows context-dependent attackers to cause a denial of service (crash) via a crafted IF
clause that results in a divide-by-zero error and a NULL pointer dereference.
Severity: 5

CVE-2007-2691
Description:
MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the
DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename
arbitrary tables.
Severity: 6
CVE-2007-2692
Description:
The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18
does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored
routines, which allows remote authenticated users to gain privileges.
Severity: 4

CVE-2007-2693
Description:
MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to
obtain sensitive information from partitioned tables via an ALTER TABLE statement.
Severity: 6

CVE-2007-3780
Description:
MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of
service (daemon crash) via a malformed password packet in the connection protocol.
Severity: 3
CVE-2007-3781
Description:
Security Fix: CREATE TABLE LIKE did not require any privileges on the source table.
Severity: 6

CVE-2007-3782
Description:
MySQL Community Server before 5.0.45 allows remote authenticated users to gain update
privileges for a table in another database via a view that refers to this external table.
Severity: 4
Fixes for Security issues not tracked with CVE IDs
The following records were taken out of the MySQL Server release notes as included in the reference
manual. Even though they have not been tracked with a CVE ID, they still are genuine security issues.

Note that this list is very likely incomplete - unfortunately not all security-relevant bug fixes are
explicitly marked as such in the release notes. The ones below were found by searching the document
for certain keywords like "security".

Description: Fixed security bug when having an empty database name in the user.db table.

Description: Fixed a security problem with SELECT and wildcarded select list, when user only had
partial column SELECT privileges on the table.

Description: Fixed a security problem that enabled users with no privileges to obtain information on the
list of existing databases by using SHOW TABLES and similar commands.

Description: Fixed a security bug: A server compiled without SSL support still allowed connections by
users who had the REQUIRE SSL option specified for their accounts.

Description: Fixed security problem in new authentication where password was not checked for
changed GRANT accounts until FLUSH PRIVILEGES was executed.

Description: mysqld was started with --user=non_existent_user, it would run using the privileges of the
account it was invoked from, even if that was root.

Description: Security update: A user with limited privileges could obtain information about the
privileges of other users by querying objects in the INFORMATION_SCHEMA database for which
that user did not have the requisite privileges.

Description: Security improvement: In grant table comparisons, improper use of a latin1 collation
caused some hostname matches to be true that should have been false. Thanks to Deomid Ryabkov for
finding this bug and proposing a solution.

Description: Security Improvement: GRANTs to users with wildcards in their host information could
be erroneously applied to similar users with the same username and similar wildcards. For example, a
privilege granted to foo@% are also applied to user foo@192.%.

Description: Security enhancement: Added the global max_prepared_stmt_count system variable to

limit the total number of prepared statements in the server. This limits the potential for denial-of-
service attacks based on running the server out of memory by preparing huge numbers of statements.
The current number of prepared statements is available through the prepared_stmt_count system
variable.