Vulnerabilities > CVE-2004-0381
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
PARTIAL Availability impact
NONE Summary
mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file.
Vulnerable Configurations
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2004-597.NASL description Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1. MySQL is a multi-user, multi-threaded SQL database server. A number security issues that affect the mysql server have been reported : Oleksandr Byelkin discovered that last seen 2020-06-01 modified 2020-06-02 plugin id 15536 published 2004-10-21 reporter This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/15536 title RHEL 2.1 : mysql (RHSA-2004:597) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2004:597. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(15536); script_version ("1.28"); script_cvs_date("Date: 2019/10/25 13:36:10"); script_cve_id("CVE-2004-0381", "CVE-2004-0388", "CVE-2004-0457", "CVE-2004-0835", "CVE-2004-0836", "CVE-2004-0837", "CVE-2004-0957"); script_xref(name:"RHSA", value:"2004:597"); script_name(english:"RHEL 2.1 : mysql (RHSA-2004:597)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1. MySQL is a multi-user, multi-threaded SQL database server. A number security issues that affect the mysql server have been reported : Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue. Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836). Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837). Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957). Additionally, the following minor temporary file vulnerabilities were discovered : - Stan Bubroski and Shaun Colley found a temporary file vulnerability in the mysqlbug script (CVE-2004-0381). - A temporary file vulnerability was discovered in mysqld_multi (CVE-2004-0388). - Jeroen van Wolffelaar discovered an temporary file vulnerability in the mysqlhotcopy script when using the scp method (CVE-2004-0457). All users of mysql should upgrade to these updated packages, which resolve these issues and also include fixes for a number of small bugs." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-0381" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-0388" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-0457" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-0835" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-0836" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-0837" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-0957" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2004:597" ); script_set_attribute( attribute:"solution", value:"Update the affected mysql, mysql-devel and / or mysql-server packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(119); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mysql-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mysql-server"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:2.1"); script_set_attribute(attribute:"vuln_publication_date", value:"2004/05/04"); script_set_attribute(attribute:"patch_publication_date", value:"2004/10/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2004/10/21"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^2\.1([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 2.1", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); if (cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i386", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2004:597"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mysql-3.23.58-1.72.1")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mysql-devel-3.23.58-1.72.1")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mysql-server-3.23.58-1.72.1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mysql / mysql-devel / mysql-server"); } }
NASL family Databases NASL id MYSQL_4_0_20.NASL description The version of MySQL installed on the remote host is older than 4.0.20. A local attacker could exploit a flaw in mysqlbug to overwite arbitrary files via a symlink attack. last seen 2020-06-01 modified 2020-06-02 plugin id 17823 published 2012-01-18 reporter This script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/17823 title MySQL < 4.0.20 File Overwrite code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(17823); script_version("1.8"); script_cvs_date("Date: 2018/11/15 20:50:21"); script_cve_id("CVE-2004-0381"); script_bugtraq_id(9976); script_name(english:"MySQL < 4.0.20 File Overwrite"); script_summary(english:"Checks version of MySQL server"); script_set_attribute(attribute:"synopsis", value: "Arbitrary files could be overwritten on the remote server."); script_set_attribute(attribute:"description", value: "The version of MySQL installed on the remote host is older than 4.0.20. A local attacker could exploit a flaw in mysqlbug to overwite arbitrary files via a symlink attack."); script_set_attribute(attribute:"see_also", value:"https://marc.info/?l=bugtraq&m=108206802810402&w=2"); script_set_attribute(attribute:"see_also", value:"http://marc.info/?l=bugtraq&m=108023246916294&w=2"); script_set_attribute(attribute:"solution", value:"Upgrade to MySQL version 4.0.20 or later."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2004/03/24"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/01/18"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:mysql:mysql"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Databases"); script_copyright(english:"This script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("mysql_version.nasl", "mysql_login.nasl"); script_require_keys("Settings/ParanoidReport"); script_require_ports("Services/mysql", 3306); exit(0); } include("mysql_version.inc"); mysql_check_version(fixed:'4.0.20', severity:SECURITY_NOTE);
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200405-20.NASL description The remote host is affected by the vulnerability described in GLSA-200405-20 (Insecure Temporary File Creation In MySQL) The MySQL bug reporting utility (mysqlbug) creates a temporary file to log bug reports to. A malicious local user with write access to the /tmp directory could create a symbolic link of the name mysqlbug-N pointing to a protected file, such as /etc/passwd, such that when mysqlbug creates the Nth log file, it would end up overwriting the target file. A similar vulnerability exists with the mysql_multi utility, which creates a temporary file called mysql_multi.log. Impact : Since mysql_multi runs as root, a local attacker could use this to destroy any other users last seen 2020-06-01 modified 2020-06-02 plugin id 14506 published 2004-08-30 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/14506 title GLSA-200405-20 : Insecure Temporary File Creation In MySQL code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 200405-20. # # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(14506); script_version("1.17"); script_cvs_date("Date: 2019/08/02 13:32:41"); script_cve_id("CVE-2004-0381", "CVE-2004-0388"); script_xref(name:"GLSA", value:"200405-20"); script_name(english:"GLSA-200405-20 : Insecure Temporary File Creation In MySQL"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-200405-20 (Insecure Temporary File Creation In MySQL) The MySQL bug reporting utility (mysqlbug) creates a temporary file to log bug reports to. A malicious local user with write access to the /tmp directory could create a symbolic link of the name mysqlbug-N pointing to a protected file, such as /etc/passwd, such that when mysqlbug creates the Nth log file, it would end up overwriting the target file. A similar vulnerability exists with the mysql_multi utility, which creates a temporary file called mysql_multi.log. Impact : Since mysql_multi runs as root, a local attacker could use this to destroy any other users' data or corrupt and destroy system files. Workaround : One could modify both scripts to log to a directory that users do not have write permission to, such as /var/log/mysql/." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/200405-20" ); script_set_attribute( attribute:"solution", value: "All users should upgrade to the latest stable version of MySQL. # emerge sync # emerge -pv '>=dev-db/mysql-4.0.18-r2' # emerge '>=dev-db/mysql-4.0.18-r2'" ); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mysql"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2004/05/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2004/08/30"); script_set_attribute(attribute:"vuln_publication_date", value:"2004/03/24"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"dev-db/mysql", unaffected:make_list("ge 4.0.18-r2"), vulnerable:make_list("lt 4.0.18-r2"))) flag++; if (flag) { if (report_verbosity > 0) security_note(port:0, extra:qpkg_report_get()); else security_note(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dev-db/mysql"); }
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_2E1298468FBB11D88B290020ED76EF5A.NASL description Shaun Colley reports that the script `mysqlbug last seen 2020-06-01 modified 2020-06-02 plugin id 37467 published 2009-04-23 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/37467 title FreeBSD : MySQL insecure temporary file creation (mysqlbug) (2e129846-8fbb-11d8-8b29-0020ed76ef5a) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2018 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(37467); script_version("1.13"); script_cvs_date("Date: 2019/08/02 13:32:36"); script_cve_id("CVE-2004-0381"); script_bugtraq_id(9976); script_name(english:"FreeBSD : MySQL insecure temporary file creation (mysqlbug) (2e129846-8fbb-11d8-8b29-0020ed76ef5a)"); script_summary(english:"Checks for updated packages in pkg_info output"); script_set_attribute( attribute:"synopsis", value: "The remote FreeBSD host is missing one or more security-related updates." ); script_set_attribute( attribute:"description", value: "Shaun Colley reports that the script `mysqlbug' included with MySQL sometimes creates temporary files in an unsafe manner. As a result, an attacker may create a symlink in /tmp so that if another user invokes `mysqlbug' and quits without making any changes, an arbitrary file may be overwritten with the bug report template." ); # http://marc.theaimsgroup.com/?l=bugtraq&m=108023246916294&w=2 script_set_attribute( attribute:"see_also", value:"https://marc.info/?l=bugtraq&m=108023246916294&w=2" ); # http://bugs.mysql.com/bug.php?id=3284 script_set_attribute( attribute:"see_also", value:"https://bugs.mysql.com/bug.php?id=3284" ); # https://vuxml.freebsd.org/freebsd/2e129846-8fbb-11d8-8b29-0020ed76ef5a.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?279ca7a7" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:mysql-client"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2004/03/25"); script_set_attribute(attribute:"patch_publication_date", value:"2004/04/16"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"mysql-client>=4.0<4.0.20")) flag++; if (pkg_test(save_report:TRUE, pkg:"mysql-client>=4.1<4.1.1_2")) flag++; if (pkg_test(save_report:TRUE, pkg:"mysql-client>=5.0<5.0.0_2")) flag++; if (flag) { if (report_verbosity > 0) security_note(port:0, extra:pkg_report_get()); else security_note(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2004-569.NASL description Updated mysql packages that fix various temporary file security issues, as well as a number of bugs, are now available. MySQL is a multi-user, multi-threaded SQL database server. This update fixes a number of small bugs, including some potential security problems associated with careless handling of temporary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0381, CVE-2004-0388, and CVE-2004-0457 to these issues. A number of additional security issues that affect mysql have been corrected in the source package. These include CVE-2004-0835, CVE-2004-0836, CVE-2004-0837, and CVE-2004-0957. Red Hat Enterprise Linux 3 does not ship with the mysql-server package and is therefore not affected by these issues. This update also allows 32-bit and 64-bit libraries to be installed concurrently on the same system. All users of mysql should upgrade to these updated packages, which resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 15534 published 2004-10-21 reporter This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/15534 title RHEL 3 : mysql (RHSA-2004:569) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2004:569. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(15534); script_version ("1.23"); script_cvs_date("Date: 2019/10/25 13:36:10"); script_cve_id("CVE-2004-0381", "CVE-2004-0388", "CVE-2004-0457"); script_xref(name:"RHSA", value:"2004:569"); script_name(english:"RHEL 3 : mysql (RHSA-2004:569)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated mysql packages that fix various temporary file security issues, as well as a number of bugs, are now available. MySQL is a multi-user, multi-threaded SQL database server. This update fixes a number of small bugs, including some potential security problems associated with careless handling of temporary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0381, CVE-2004-0388, and CVE-2004-0457 to these issues. A number of additional security issues that affect mysql have been corrected in the source package. These include CVE-2004-0835, CVE-2004-0836, CVE-2004-0837, and CVE-2004-0957. Red Hat Enterprise Linux 3 does not ship with the mysql-server package and is therefore not affected by these issues. This update also allows 32-bit and 64-bit libraries to be installed concurrently on the same system. All users of mysql should upgrade to these updated packages, which resolve these issues." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-0381" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-0388" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-0457" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2004:569" ); script_set_attribute( attribute:"solution", value:"Update the affected mysql, mysql-bench and / or mysql-devel packages." ); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mysql-bench"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mysql-devel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3"); script_set_attribute(attribute:"vuln_publication_date", value:"2004/05/04"); script_set_attribute(attribute:"patch_publication_date", value:"2004/10/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2004/10/21"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^3([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 3.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2004:569"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL3", reference:"mysql-3.23.58-2.3")) flag++; if (rpm_check(release:"RHEL3", reference:"mysql-bench-3.23.58-2.3")) flag++; if (rpm_check(release:"RHEL3", reference:"mysql-devel-3.23.58-2.3")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mysql / mysql-bench / mysql-devel"); } }
NASL family FreeBSD Local Security Checks NASL id FREEBSD_MYSQL_CLIENT_4020.NASL description The following package needs to be updated: mysql-client last seen 2016-09-26 modified 2011-10-03 plugin id 12583 published 2004-07-06 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=12583 title FreeBSD : MySQL insecure temporary file creation (mysqlbug) (123) code #%NASL_MIN_LEVEL 999999 # @DEPRECATED@ # # This script has been deprecated by freebsd_pkg_2e1298468fbb11d88b290020ed76ef5a.nasl. # # Disabled on 2011/10/02. # # # (C) Tenable Network Security, Inc. # # This script contains information extracted from VuXML : # # Copyright 2003-2006 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # # # include('compat.inc'); if ( description ) { script_id(12583); script_version("1.13"); script_bugtraq_id(9976); script_cve_id("CVE-2004-0381"); script_name(english:"FreeBSD : MySQL insecure temporary file creation (mysqlbug) (123)"); script_set_attribute(attribute:'synopsis', value: 'The remote host is missing a security update'); script_set_attribute(attribute:'description', value:'The following package needs to be updated: mysql-client'); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:'solution', value: 'Update the package on the remote host'); script_set_attribute(attribute: 'see_also', value: 'http://awstats.sourceforge.net/awstats_security_news.php http://bugs.mysql.com/bug.php?id=3284 http://www.mozilla.org/security/announce/2008/mfsa2008-60.html http://www.mozilla.org/security/announce/2008/mfsa2008-61.html http://www.mozilla.org/security/announce/2008/mfsa2008-62.html http://www.mozilla.org/security/announce/2008/mfsa2008-63.html http://www.mozilla.org/security/announce/2008/mfsa2008-64.html http://www.samba.org/samba/whatsnew/samba-2.2.10.html http://www.samba.org/samba/whatsnew/samba-3.0.5.html https://bugs.kde.org/show_bug.cgi?id=103331'); script_set_attribute(attribute:'see_also', value: 'http://www.FreeBSD.org/ports/portaudit/2e129846-8fbb-11d8-8b29-0020ed76ef5a.html'); script_set_attribute(attribute:"plugin_publication_date", value: "2004/07/06"); script_cvs_date("Date: 2018/07/20 0:18:52"); script_end_attributes(); script_summary(english:"Check for mysql-client"); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc."); family["english"] = "FreeBSD Local Security Checks"; script_family(english:family["english"]); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/FreeBSD/pkg_info"); exit(0); } # Deprecated. exit(0, "This plugin has been deprecated. Refer to plugin #37467 (freebsd_pkg_2e1298468fbb11d88b290020ed76ef5a.nasl) instead."); global_var cvss_score; cvss_score=2; include('freebsd_package.inc'); pkg_test(pkg:"mysql-client>=4.0<4.0.20"); pkg_test(pkg:"mysql-client>=4.1<4.1.1_2"); pkg_test(pkg:"mysql-client>=5.0<5.0.0_2");
NASL family Fedora Local Security Checks NASL id FEDORA_2004-530.NASL description - Tue Oct 12 2004 Tom Lane <tgl at redhat.com> 3.23.58-9.1 - fix security issues CVE-2004-0835, CVE-2004-0836, CVE-2004-0837 (bugs #135372, 135375, 135387) - fix privilege escalation on GRANT ALL ON `Foo\_Bar` (CVE-2004-0957) - fix multilib problem with mysqlbug and mysql_config - adjust chkconfig priority per bug #128852 - remove bogus quoting per bug #129409 (MySQL 4.0 has done likewise) - add sleep to mysql.init restart(); may or may not fix bug #133993 - fix low-priority security issues CVE-2004-0388, CVE-2004-0381, CVE-2004-0457 (bugs #119442, 125991, 130347, 130348) - fix bug with dropping databases under recent kernels (bug #124352) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 15930 published 2004-12-09 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/15930 title Fedora Core 2 : mysql-3.23.58-9.1 (2004-530) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2004-530. # include("compat.inc"); if (description) { script_id(15930); script_version ("1.14"); script_cvs_date("Date: 2019/08/02 13:32:23"); script_xref(name:"FEDORA", value:"2004-530"); script_name(english:"Fedora Core 2 : mysql-3.23.58-9.1 (2004-530)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora Core host is missing a security update." ); script_set_attribute( attribute:"description", value: " - Tue Oct 12 2004 Tom Lane <tgl at redhat.com> 3.23.58-9.1 - fix security issues CVE-2004-0835, CVE-2004-0836, CVE-2004-0837 (bugs #135372, 135375, 135387) - fix privilege escalation on GRANT ALL ON `Foo\_Bar` (CVE-2004-0957) - fix multilib problem with mysqlbug and mysql_config - adjust chkconfig priority per bug #128852 - remove bogus quoting per bug #129409 (MySQL 4.0 has done likewise) - add sleep to mysql.init restart(); may or may not fix bug #133993 - fix low-priority security issues CVE-2004-0388, CVE-2004-0381, CVE-2004-0457 (bugs #119442, 125991, 130347, 130348) - fix bug with dropping databases under recent kernels (bug #124352) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); # https://lists.fedoraproject.org/pipermail/announce/2004-December/000481.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?3ded8ed2" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_attribute(attribute:"risk_factor", value:"High"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mysql-bench"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mysql-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mysql-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mysql-server"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora_core:2"); script_set_attribute(attribute:"patch_publication_date", value:"2004/12/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2004/12/09"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^2([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 2.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC2", reference:"mysql-3.23.58-9.1")) flag++; if (rpm_check(release:"FC2", reference:"mysql-bench-3.23.58-9.1")) flag++; if (rpm_check(release:"FC2", reference:"mysql-debuginfo-3.23.58-9.1")) flag++; if (rpm_check(release:"FC2", reference:"mysql-devel-3.23.58-9.1")) flag++; if (rpm_check(release:"FC2", reference:"mysql-server-3.23.58-9.1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mysql / mysql-bench / mysql-debuginfo / mysql-devel / mysql-server"); }
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-483.NASL description Two vulnerabilities have been discovered in mysql, a common database system. Two scripts contained in the package don last seen 2020-06-01 modified 2020-06-02 plugin id 15320 published 2004-09-29 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/15320 title Debian DSA-483-1 : mysql - insecure temporary file creation code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-483. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(15320); script_version("1.25"); script_cvs_date("Date: 2019/08/02 13:32:18"); script_cve_id("CVE-2004-0381", "CVE-2004-0388"); script_bugtraq_id(9976, 10142); script_xref(name:"DSA", value:"483"); script_name(english:"Debian DSA-483-1 : mysql - insecure temporary file creation"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Two vulnerabilities have been discovered in mysql, a common database system. Two scripts contained in the package don't create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking the MySQL server, which is often the root user. The Common Vulnerabilities and Exposures identifies the following problems : - CAN-2004-0381 The script mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack. - CAN-2004-0388 The script mysqld_multi in MySQL allows local users to overwrite arbitrary files via a symlink attack." ); script_set_attribute( attribute:"see_also", value:"http://www.debian.org/security/2004/dsa-483" ); script_set_attribute( attribute:"solution", value: "Upgrade the mysql, mysql-dfsg and related packages. For the stable distribution (woody) these problems have been fixed in version 3.23.49-8.6." ); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mysql"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0"); script_set_attribute(attribute:"patch_publication_date", value:"2004/04/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/29"); script_set_attribute(attribute:"vuln_publication_date", value:"2004/03/24"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"3.0", prefix:"libmysqlclient10", reference:"3.23.49-8.6")) flag++; if (deb_check(release:"3.0", prefix:"libmysqlclient10-dev", reference:"3.23.49-8.6")) flag++; if (deb_check(release:"3.0", prefix:"mysql-client", reference:"3.23.49-8.6")) flag++; if (deb_check(release:"3.0", prefix:"mysql-common", reference:"3.23.49-8.6")) flag++; if (deb_check(release:"3.0", prefix:"mysql-server", reference:"3.23.49-8.6")) flag++; if (flag) { if (report_verbosity > 0) security_note(port:0, extra:deb_report_get()); else security_note(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2004-034.NASL description Shaun Colley discovered that two scripts distributed with MySQL, the last seen 2020-06-01 modified 2020-06-02 plugin id 14133 published 2004-07-31 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/14133 title Mandrake Linux Security Advisory : MySQL (MDKSA-2004:034) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandrake Linux Security Advisory MDKSA-2004:034. # The text itself is copyright (C) Mandriva S.A. # include("compat.inc"); if (description) { script_id(14133); script_version ("1.19"); script_cvs_date("Date: 2019/08/02 13:32:47"); script_cve_id("CVE-2004-0381", "CVE-2004-0388"); script_xref(name:"MDKSA", value:"2004:034"); script_name(english:"Mandrake Linux Security Advisory : MySQL (MDKSA-2004:034)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Mandrake Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Shaun Colley discovered that two scripts distributed with MySQL, the 'mysqld_multi' and 'mysqlbug' scripts, did not create temporary files in a secure fashion. An attacker could create symbolic links in /tmp that could allow for overwriting of files with the privileges of the user running the scripts. The scripts have been patched in the updated packages to prevent this behaviour." ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:MySQL"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:MySQL-Max"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:MySQL-bench"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:MySQL-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:MySQL-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64mysql12"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64mysql12-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libmysql12"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libmysql12-devel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.0"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:9.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:9.2"); script_set_attribute(attribute:"patch_publication_date", value:"2004/04/19"); script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/31"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"MySQL-4.0.18-1.1.100mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"MySQL-Max-4.0.18-1.1.100mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"MySQL-bench-4.0.18-1.1.100mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"MySQL-client-4.0.18-1.1.100mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"MySQL-common-4.0.18-1.1.100mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libmysql12-4.0.18-1.1.100mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libmysql12-devel-4.0.18-1.1.100mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"MySQL-4.0.11a-5.2.91mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"MySQL-Max-4.0.11a-5.2.91mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"MySQL-bench-4.0.11a-5.2.91mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"MySQL-client-4.0.11a-5.2.91mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"MySQL-common-4.0.11a-5.2.91mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"libmysql12-4.0.11a-5.2.91mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"libmysql12-devel-4.0.11a-5.2.91mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.2", reference:"MySQL-4.0.15-1.1.92mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.2", reference:"MySQL-Max-4.0.15-1.1.92mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.2", reference:"MySQL-bench-4.0.15-1.1.92mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.2", reference:"MySQL-client-4.0.15-1.1.92mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.2", reference:"MySQL-common-4.0.15-1.1.92mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64mysql12-4.0.15-1.1.92mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64mysql12-devel-4.0.15-1.1.92mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libmysql12-4.0.15-1.1.92mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libmysql12-devel-4.0.15-1.1.92mdk", yank:"mdk")) flag++; if (flag) { if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get()); else security_note(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
Oval
accepted | 2013-04-29T04:14:41.367-04:00 | ||||||||
class | vulnerability | ||||||||
contributors |
| ||||||||
definition_extensions |
| ||||||||
description | mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file. | ||||||||
family | unix | ||||||||
id | oval:org.mitre.oval:def:11557 | ||||||||
status | accepted | ||||||||
submitted | 2010-07-09T03:56:16-04:00 | ||||||||
title | mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file. | ||||||||
version | 27 |
Redhat
advisories |
| ||||||||
rpms |
|
References
- http://marc.info/?l=bugtraq&m=108023246916294&w=2
- http://marc.info/?l=bugtraq&m=108206802810402&w=2
- http://security.gentoo.org/glsa/glsa-200405-20.xml
- http://www.ciac.org/ciac/bulletins/p-018.shtml
- http://www.debian.org/security/2004/dsa-483
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:034
- http://www.redhat.com/support/errata/RHSA-2004-569.html
- http://www.redhat.com/support/errata/RHSA-2004-597.html
- http://www.securityfocus.com/bid/9976
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15617
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11557