Vulnerabilities > CVE-2009-4028 - Improper Input Validation vulnerability in multiple products

CVSS 6.8 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

mysql

oracle

CWE-20

nessus

NVD

Published: 2009-11-30

Updated: 2019-12-17

Summary

The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

Vulnerable Configurations

Part	Description	Count
Application	Mysql Mysql Mysql 5.0.0 Mysql Mysql 5.0.1 Mysql Mysql 5.0.2 Mysql Mysql 5.0.3 Mysql Mysql 5.0.4 Mysql Mysql 5.0.5 Mysql Mysql 5.0.5.0.21 Mysql Mysql 5.0.10 Mysql Mysql 5.0.15 Mysql Mysql 5.0.16 Mysql Mysql 5.0.17 Mysql Mysql 5.0.20 Mysql Mysql 5.0.22.1.0.1 Mysql Mysql 5.0.24 Mysql Mysql 5.0.30 Mysql Mysql 5.0.36 Mysql Mysql 5.0.44 Mysql Mysql 5.0.54 Mysql Mysql 5.0.56 Mysql Mysql 5.0.60 Mysql Mysql 5.0.66 Mysql Mysql 5.0.82 Mysql Mysql 5.0.84 Mysql Mysql - Mysql Mysql 3.20 Mysql Mysql 3.20.32A Mysql Mysql 3.21 Mysql Mysql 3.22 Mysql Mysql 3.22.26 Mysql Mysql 3.22.27 Mysql Mysql 3.22.28 Mysql Mysql 3.22.29 Mysql Mysql 3.22.30 Mysql Mysql 3.22.32 Mysql Mysql 3.23 Mysql Mysql 3.23.0 Mysql Mysql 3.23.1 Mysql Mysql 3.23.2 Mysql Mysql 3.23.3 Mysql Mysql 3.23.4 Mysql Mysql 3.23.5 Mysql Mysql 3.23.6 Mysql Mysql 3.23.7 Mysql Mysql 3.23.8 Mysql Mysql 3.23.9 Mysql Mysql 3.23.10 Mysql Mysql 3.23.11 Mysql Mysql 3.23.12 Mysql Mysql 3.23.13 Mysql Mysql 3.23.14 Mysql Mysql 3.23.15 Mysql Mysql 3.23.16 Mysql Mysql 3.23.17 Mysql Mysql 3.23.18 Mysql Mysql 3.23.19 Mysql Mysql 3.23.20 Mysql Mysql 3.23.21 Mysql Mysql 3.23.22 Mysql Mysql 3.23.23 Mysql Mysql 3.23.24 Mysql Mysql 3.23.25 Mysql Mysql 3.23.26 Mysql Mysql 3.23.27 Mysql Mysql 3.23.28 Mysql Mysql 3.23.29 Mysql Mysql 3.23.30 Mysql Mysql 3.23.31 Mysql Mysql 3.23.32 Mysql Mysql 3.23.33 Mysql Mysql 3.23.34 Mysql Mysql 3.23.35 Mysql Mysql 3.23.36 Mysql Mysql 3.23.37 Mysql Mysql 3.23.38 Mysql Mysql 3.23.39 Mysql Mysql 3.23.40 Mysql Mysql 3.23.41 Mysql Mysql 3.23.42 Mysql Mysql 3.23.43 Mysql Mysql 3.23.44 Mysql Mysql 3.23.45 Mysql Mysql 3.23.46 Mysql Mysql 3.23.47 Mysql Mysql 3.23.48 Mysql Mysql 3.23.49 Mysql Mysql 3.23.50 Mysql Mysql 3.23.51 Mysql Mysql 3.23.52 Mysql Mysql 3.23.53 Mysql Mysql 3.23.53A Mysql Mysql 3.23.54 Mysql Mysql 3.23.54A Mysql Mysql 3.23.55 Mysql Mysql 3.23.56 Mysql Mysql 3.23.57 Mysql Mysql 3.23.58 Mysql Mysql 3.23.59 Mysql Mysql 4.0.0 Mysql Mysql 4.0.1 Mysql Mysql 4.0.2 Mysql Mysql 4.0.3 Mysql Mysql 4.0.4 Mysql Mysql 4.0.5 Mysql Mysql 4.0.5A Mysql Mysql 4.0.6 Mysql Mysql 4.0.7 Mysql Mysql 4.0.8 Mysql Mysql 4.0.9 Mysql Mysql 4.0.10 Mysql Mysql 4.0.11 Mysql Mysql 4.0.12 Mysql Mysql 4.0.13 Mysql Mysql 4.0.14 Mysql Mysql 4.0.15 Mysql Mysql 4.0.16 Mysql Mysql 4.0.17 Mysql Mysql 4.0.18 Mysql Mysql 4.0.19 Mysql Mysql 4.0.20 Mysql Mysql 4.0.21 Mysql Mysql 4.0.23 Mysql Mysql 4.0.24 Mysql Mysql 4.0.25 Mysql Mysql 4.0.26 Mysql Mysql 4.0.27 Mysql Mysql 4.1 Mysql Mysql 4.1.0 Mysql Mysql 4.1.0.0 Mysql Mysql 4.1.1 Mysql Mysql 4.1.2 Mysql Mysql 4.1.3 Mysql Mysql 4.1.4 Mysql Mysql 4.1.5 Mysql Mysql 4.1.6 Mysql Mysql 4.1.7 Mysql Mysql 4.1.8 Mysql Mysql 4.1.8A Mysql Mysql 4.1.9 Mysql Mysql 4.1.10 Mysql Mysql 4.1.10A Mysql Mysql 4.1.11 Mysql Mysql 4.1.12 Mysql Mysql 4.1.12A Mysql Mysql 4.1.13 Mysql Mysql 4.1.13A Mysql Mysql 4.1.14 Mysql Mysql 4.1.14A Mysql Mysql 4.1.15 Mysql Mysql 4.1.15A Mysql Mysql 4.1.16 Mysql Mysql 4.1.17 Mysql Mysql 4.1.18 Mysql Mysql 4.1.19 Mysql Mysql 4.1.20 Mysql Mysql 4.1.21 Mysql Mysql 4.1.22 Mysql Mysql 4.1.24 Mysql Mysql 5.0 Mysql Mysql 5.0.0.0 Mysql Mysql 5.0.1A Mysql Mysql 5.0.3A Mysql Mysql 5.0.4A Mysql Mysql 5.0.6 Mysql Mysql 5.0.7 Mysql Mysql 5.0.8 Mysql Mysql 5.0.9 Mysql Mysql 5.0.10A Mysql Mysql 5.0.11 Mysql Mysql 5.0.12 Mysql Mysql 5.0.13 Mysql Mysql 5.0.14 Mysql Mysql 5.0.15A Mysql Mysql 5.0.16A Mysql Mysql 5.0.17A Mysql Mysql 5.0.18 Mysql Mysql 5.0.19 Mysql Mysql 5.0.20A Mysql Mysql 5.0.21 Mysql Mysql 5.0.22 Mysql Mysql 5.0.23 Mysql Mysql 5.0.24A Mysql Mysql 5.0.25 Mysql Mysql 5.0.26 Mysql Mysql 5.0.27 Mysql Mysql 5.0.28 Mysql Mysql 5.0.32 Mysql Mysql 5.0.33 Mysql Mysql 5.0.34 Mysql Mysql 5.0.37 Mysql Mysql 5.0.38 Mysql Mysql 5.0.40 Mysql Mysql 5.0.41 Mysql Mysql 5.0.42 Mysql Mysql 5.0.45 Mysql Mysql 5.0.46 Mysql Mysql 5.0.48 Mysql Mysql 5.0.50 Mysql Mysql 5.0.51 Mysql Mysql 5.0.51A Mysql Mysql 5.0.51B Mysql Mysql 5.0.52 Mysql Mysql 5.0.54A Mysql Mysql 5.0.58 Mysql Mysql 5.0.62 Mysql Mysql 5.0.64 Mysql Mysql 5.0.66A Mysql Mysql 5.0.67 Mysql Mysql 5.0.68 Mysql Mysql 5.0.70 Mysql Mysql 5.0.72 Mysql Mysql 5.0.74 Mysql Mysql 5.0.75 Mysql Mysql 5.0.76 Mysql Mysql 5.0.77 Mysql Mysql 5.0.78 Mysql Mysql 5.0.79 Mysql Mysql 5.0.80 Mysql Mysql 5.0.81 Mysql Mysql 5.0.83 Mysql Mysql 5.0.85 Mysql Mysql 5.0.86 Mysql Mysql 5.0.87 Mysql Mysql 5.1.5 Mysql Mysql 5.1.23 Mysql Mysql 5.1.31 Mysql Mysql 5.1.32 Mysql Mysql 5.1.34 Mysql Mysql 5.1.37	301
Application	Oracle Oracle Mysql 5.0.0 Oracle Mysql 5.0.3 Oracle Mysql 5.0.6 Oracle Mysql 5.0.7 Oracle Mysql 5.0.8 Oracle Mysql 5.0.11 Oracle Mysql 5.0.12 Oracle Mysql 5.0.13 Oracle Mysql 5.0.14 Oracle Mysql 5.0.18 Oracle Mysql 5.0.19 Oracle Mysql 5.0.21 Oracle Mysql 5.0.22 Oracle Mysql 5.0.23 Oracle Mysql 5.0.25 Oracle Mysql 5.0.26 Oracle Mysql 5.0.27 Oracle Mysql 5.0.30 Oracle Mysql 5.0.32 Oracle Mysql 5.0.33 Oracle Mysql 5.0.37 Oracle Mysql 5.0.38 Oracle Mysql 5.0.41 Oracle Mysql 5.0.42 Oracle Mysql 5.0.45 Oracle Mysql 5.0.50 Oracle Mysql 5.0.51 Oracle Mysql 5.0.52 Oracle Mysql 5.0.75 Oracle Mysql 5.0.77 Oracle Mysql 5.0.81 Oracle Mysql 5.0.83 Oracle Mysql 5.0.85 Oracle Mysql 5.0.86 Oracle Mysql 5.1 Oracle Mysql 5.1.1 Oracle Mysql 5.1.2 Oracle Mysql 5.1.3 Oracle Mysql 5.1.4 Oracle Mysql 5.1.6 Oracle Mysql 5.1.7 Oracle Mysql 5.1.8 Oracle Mysql 5.1.9 Oracle Mysql 5.1.10 Oracle Mysql 5.1.11 Oracle Mysql 5.1.12 Oracle Mysql 5.1.13 Oracle Mysql 5.1.14 Oracle Mysql 5.1.15 Oracle Mysql 5.1.16 Oracle Mysql 5.1.17 Oracle Mysql 5.1.18 Oracle Mysql 5.1.19 Oracle Mysql 5.1.20 Oracle Mysql 5.1.21 Oracle Mysql 5.1.22 Oracle Mysql 5.1.23 Oracle Mysql 5.1.24 Oracle Mysql 5.1.25 Oracle Mysql 5.1.26 Oracle Mysql 5.1.27 Oracle Mysql 5.1.28 Oracle Mysql 5.1.29 Oracle Mysql 5.1.30 Oracle Mysql 5.1.31 Oracle Mysql 5.1.33 Oracle Mysql 5.1.34 Oracle Mysql 5.1.35 Oracle Mysql 5.1.36 Oracle Mysql 5.1.37 Oracle Mysql 5.1.38 Oracle Mysql 5.1.39 Oracle Mysql 5.1.40	74

Common Weakness Enumeration (CWE)

CWE-20 - Improper Input Validation

Common Attack Pattern Enumeration and Classification (CAPEC)

Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Server Side Include (SSI) Injection
An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
Cross Zone Scripting
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
Cross Site Scripting through Log Files
An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
Command Line Execution through SQL Injection
An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Nessus

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2010-0109.NASL
description	Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. It was discovered that the MySQL client ignored certain SSL certificate verification errors when connecting to servers. A man-in-the-middle attacker could use this flaw to trick MySQL clients into connecting to a spoofed MySQL server. (CVE-2009-4028) Note: This fix may uncover previously hidden SSL configuration issues, such as incorrect CA certificates being used by clients or expired server certificates. This update should be carefully tested in deployments where SSL connections are used. A flaw was found in the way MySQL handled SELECT statements with subqueries in the WHERE clause, that assigned results to a user variable. A remote, authenticated attacker could use this flaw to crash the MySQL server daemon (mysqld). This issue only caused a temporary denial of service, as the MySQL daemon was automatically restarted after the crash. (CVE-2009-4019) When the
last seen	2020-06-01
modified	2020-06-02
plugin id	44948
published	2010-03-02
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/44948
title	CentOS 5 : mysql (CESA-2010:0109)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2010:0109 and # CentOS Errata and Security Advisory 2010:0109 respectively. # include("compat.inc"); if (description) { script_id(44948); script_version("1.12"); script_cvs_date("Date: 2019/10/25 13:36:05"); script_cve_id("CVE-2008-2079", "CVE-2008-4098", "CVE-2009-4019", "CVE-2009-4028", "CVE-2009-4030"); script_bugtraq_id(37075, 37076, 37297); script_xref(name:"RHSA", value:"2010:0109"); script_name(english:"CentOS 5 : mysql (CESA-2010:0109)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote CentOS host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. It was discovered that the MySQL client ignored certain SSL certificate verification errors when connecting to servers. A man-in-the-middle attacker could use this flaw to trick MySQL clients into connecting to a spoofed MySQL server. (CVE-2009-4028) Note: This fix may uncover previously hidden SSL configuration issues, such as incorrect CA certificates being used by clients or expired server certificates. This update should be carefully tested in deployments where SSL connections are used. A flaw was found in the way MySQL handled SELECT statements with subqueries in the WHERE clause, that assigned results to a user variable. A remote, authenticated attacker could use this flaw to crash the MySQL server daemon (mysqld). This issue only caused a temporary denial of service, as the MySQL daemon was automatically restarted after the crash. (CVE-2009-4019) When the 'datadir' option was configured with a relative path, MySQL did not properly check paths used as arguments for the DATA DIRECTORY and INDEX DIRECTORY directives. An authenticated attacker could use this flaw to bypass the restriction preventing the use of subdirectories of the MySQL data directory being used as DATA DIRECTORY and INDEX DIRECTORY paths. (CVE-2009-4030) Note: Due to the security risks and previous security issues related to the use of the DATA DIRECTORY and INDEX DIRECTORY directives, users not depending on this feature should consider disabling it by adding 'symbolic-links=0' to the '[mysqld]' section of the 'my.cnf' configuration file. In this update, an example of such a configuration was added to the default 'my.cnf' file. All MySQL users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically." ); # https://lists.centos.org/pipermail/centos-announce/2010-March/016527.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?617de9bd" ); # https://lists.centos.org/pipermail/centos-announce/2010-March/016528.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?f8ea863b" ); script_set_attribute( attribute:"solution", value:"Update the affected mysql packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(20, 59, 264); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:mysql-bench"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:mysql-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:mysql-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:mysql-test"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5"); script_set_attribute(attribute:"vuln_publication_date", value:"2008/05/05"); script_set_attribute(attribute:"patch_publication_date", value:"2010/03/01"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/03/02"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"CentOS Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/CentOS/release"); if (isnull(release) \|\| "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS"); os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS"); os_ver = os_ver[1]; if (! preg(pattern:"^5([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x", "CentOS " + os_ver); if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu); flag = 0; if (rpm_check(release:"CentOS-5", reference:"mysql-5.0.77-4.el5_4.2")) flag++; if (rpm_check(release:"CentOS-5", reference:"mysql-bench-5.0.77-4.el5_4.2")) flag++; if (rpm_check(release:"CentOS-5", reference:"mysql-devel-5.0.77-4.el5_4.2")) flag++; if (rpm_check(release:"CentOS-5", reference:"mysql-server-5.0.77-4.el5_4.2")) flag++; if (rpm_check(release:"CentOS-5", reference:"mysql-test-5.0.77-4.el5_4.2")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mysql / mysql-bench / mysql-devel / mysql-server / mysql-test"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_0_LIBMYSQLCLIENT-DEVEL-091216.NASL
description	This update fixes several security issues in mysql : - checking server certificates (CVE-2009-4028) - error handling in subqueries (CVE-2009-4019) - preserving null_value flag in GeomFromWKB (CVE-2009-4019) - symlink behavior fixed (CVE-2008-7247) - symlink behavior refixed (CVE-2009-4030)
last seen	2020-06-01
modified	2020-06-02
plugin id	46218
published	2010-05-04
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/46218
title	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update libmysqlclient-devel-1706. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(46218); script_version("1.10"); script_cvs_date("Date: 2019/10/25 13:36:34"); script_cve_id("CVE-2008-7247", "CVE-2009-4019", "CVE-2009-4028", "CVE-2009-4030"); script_name(english:"openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)"); script_summary(english:"Check for the libmysqlclient-devel-1706 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update fixes several security issues in mysql : - checking server certificates (CVE-2009-4028) - error handling in subqueries (CVE-2009-4019) - preserving null_value flag in GeomFromWKB (CVE-2009-4019) - symlink behavior fixed (CVE-2008-7247) - symlink behavior refixed (CVE-2009-4030)" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=557669" ); script_set_attribute( attribute:"see_also", value:"https://lists.opensuse.org/opensuse-updates/2010-05/msg00000.html" ); script_set_attribute( attribute:"solution", value:"Update the affected libmysqlclient-devel packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_cwe_id(20, 59); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient15"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient15-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient_r15"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient_r15-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-Max"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-bench"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-debug"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-tools"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0"); script_set_attribute(attribute:"patch_publication_date", value:"2009/12/16"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/05/04"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.0", reference:"libmysqlclient-devel-5.0.51a-27.6") ) flag++; if ( rpm_check(release:"SUSE11.0", reference:"libmysqlclient15-5.0.51a-27.6") ) flag++; if ( rpm_check(release:"SUSE11.0", reference:"libmysqlclient_r15-5.0.51a-27.6") ) flag++; if ( rpm_check(release:"SUSE11.0", reference:"mysql-5.0.51a-27.6") ) flag++; if ( rpm_check(release:"SUSE11.0", reference:"mysql-Max-5.0.51a-27.6") ) flag++; if ( rpm_check(release:"SUSE11.0", reference:"mysql-bench-5.0.51a-27.6") ) flag++; if ( rpm_check(release:"SUSE11.0", reference:"mysql-client-5.0.51a-27.6") ) flag++; if ( rpm_check(release:"SUSE11.0", reference:"mysql-debug-5.0.51a-27.6") ) flag++; if ( rpm_check(release:"SUSE11.0", reference:"mysql-tools-5.0.51a-27.6") ) flag++; if ( rpm_check(release:"SUSE11.0", cpu:"x86_64", reference:"libmysqlclient15-32bit-5.0.51a-27.6") ) flag++; if ( rpm_check(release:"SUSE11.0", cpu:"x86_64", reference:"libmysqlclient_r15-32bit-5.0.51a-27.6") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libmysqlclient-devel / libmysqlclient15 / libmysqlclient15-32bit / etc"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_2_LIBMYSQLCLIENT-DEVEL-091215.NASL
description	This update fixes several security issues in mysql : - checking server certificates (CVE-2009-4028) - error handling in subqueries (CVE-2009-4019) - preserving null_value flag in GeomFromWKB (CVE-2009-4019) - symlink behavior fixed (CVE-2008-7247) - symlink behavior refixed (CVE-2009-4030)
last seen	2020-06-01
modified	2020-06-02
plugin id	46220
published	2010-05-04
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/46220
title	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update libmysqlclient-devel-1706. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(46220); script_version("1.10"); script_cvs_date("Date: 2019/10/25 13:36:35"); script_cve_id("CVE-2008-7247", "CVE-2009-4019", "CVE-2009-4028", "CVE-2009-4030"); script_name(english:"openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)"); script_summary(english:"Check for the libmysqlclient-devel-1706 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update fixes several security issues in mysql : - checking server certificates (CVE-2009-4028) - error handling in subqueries (CVE-2009-4019) - preserving null_value flag in GeomFromWKB (CVE-2009-4019) - symlink behavior fixed (CVE-2008-7247) - symlink behavior refixed (CVE-2009-4030)" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=557669" ); script_set_attribute( attribute:"see_also", value:"https://lists.opensuse.org/opensuse-updates/2010-05/msg00000.html" ); script_set_attribute( attribute:"solution", value:"Update the affected libmysqlclient-devel packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_cwe_id(20, 59); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient16"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient16-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient_r16"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient_r16-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqld-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-bench"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-debug"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-ndb-extra"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-ndb-management"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-ndb-storage"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-ndb-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql-tools"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.2"); script_set_attribute(attribute:"patch_publication_date", value:"2009/12/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/05/04"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.2", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.2", reference:"libmysqlclient-devel-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"libmysqlclient16-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"libmysqlclient_r16-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"libmysqld-devel-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"mysql-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"mysql-bench-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"mysql-client-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"mysql-debug-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"mysql-ndb-extra-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"mysql-ndb-management-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"mysql-ndb-storage-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"mysql-ndb-tools-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"mysql-test-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"mysql-tools-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", cpu:"x86_64", reference:"libmysqlclient16-32bit-5.1.36-6.8.2") ) flag++; if ( rpm_check(release:"SUSE11.2", cpu:"x86_64", reference:"libmysqlclient_r16-32bit-5.1.36-6.8.2") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libmysqlclient-devel / libmysqlclient16 / libmysqlclient16-32bit / etc"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_2_LIBMYSQLCLIENT-DEVEL-100401.NASL
description	Updated mysql packages fix the following bugs : - upstream #47320 - checking server certificates (CVE-2009-4028) - upstream #48291 - error handling in subqueries (CVE-2009-4019) - upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) - upstream #39277 - symlink behaviour fixed (CVE-2008-7247) - upstream #32167 - symlink behaviour refixed (CVE-2009-4030)
last seen	2020-06-01
modified	2020-06-02
plugin id	46235
published	2010-05-05
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/46235
title	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)

NASL family	SuSE Local Security Checks
NASL id	SUSE_MYSQL-6899.NASL
description	This update fixes various security issues (bnc#557669) : upstream #47320 - checking server certificates (CVE-2009-4028) upstream #48291 - error handling in subqueries (CVE-2009-4019) upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) upstream #39277 - symlink behaviour fixed (CVE-2008-7247) upstream #32167 - symlink behaviour refixed (CVE-2009-4030) fixing remote buffer overflow. (CVE-2009-4484)
last seen	2020-06-01
modified	2020-06-02
plugin id	49903
published	2010-10-11
reporter	This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/49903
title	SuSE 10 Security Update : MySQL (ZYPP Patch Number 6899)

NASL family	SuSE Local Security Checks
NASL id	SUSE_MYSQL-6897.NASL
description	This update fixes various security issues (bnc#557669) : upstream #47320 - checking server certificates (CVE-2009-4028) upstream #48291 - error handling in subqueries (CVE-2009-4019) upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) upstream #39277 - symlink behaviour fixed (CVE-2008-7247) upstream #32167 - symlink behaviour refixed (CVE-2009-4030) fixing remote buffer overflow. (CVE-2009-4484)
last seen	2020-06-01
modified	2020-06-02
plugin id	45107
published	2010-03-19
reporter	This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/45107
title	SuSE 10 Security Update : MySQL (ZYPP Patch Number 6897)

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2010-011.NASL
description	Multiple vulnerabilities has been found and corrected in mysql : mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement (CVE-2009-4019). The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library (CVE-2009-4028). MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079 (CVE-2009-4030). Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers. The updated packages have been patched to correct these issues. Additionally for 2009.0 and MES5 mysql has also been upgraded to the last stable 5.0 release (5.0.89).
last seen	2020-06-01
modified	2020-06-02
plugin id	44043
published	2010-01-18
reporter	This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/44043
title	Mandriva Linux Security Advisory : mysql (MDVSA-2010:011)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2010-0109.NASL
description	Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. It was discovered that the MySQL client ignored certain SSL certificate verification errors when connecting to servers. A man-in-the-middle attacker could use this flaw to trick MySQL clients into connecting to a spoofed MySQL server. (CVE-2009-4028) Note: This fix may uncover previously hidden SSL configuration issues, such as incorrect CA certificates being used by clients or expired server certificates. This update should be carefully tested in deployments where SSL connections are used. A flaw was found in the way MySQL handled SELECT statements with subqueries in the WHERE clause, that assigned results to a user variable. A remote, authenticated attacker could use this flaw to crash the MySQL server daemon (mysqld). This issue only caused a temporary denial of service, as the MySQL daemon was automatically restarted after the crash. (CVE-2009-4019) When the
last seen	2020-06-01
modified	2020-06-02
plugin id	44634
published	2010-02-17
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/44634
title	RHEL 5 : mysql (RHSA-2010:0109)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_LIBMYSQLCLIENT-DEVEL-100429.NASL
description	Updated MySQL packages fix the following bugs : - upstream #47320 - checking server certificates. (CVE-2009-4028) - upstream #48291 - error handling in subqueries. (CVE-2009-4019) - upstream #47780 - preserving null_value flag in GeomFromWKB(). (CVE-2009-4019) - upstream #39277 - symlink behaviour fixed. (CVE-2008-7247) - upstream #32167 - symlink behaviour refixed (CVE-2009-4030)
last seen	2020-06-01
modified	2020-06-02
plugin id	50935
published	2010-12-02
reporter	This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/50935
title	SuSE 11 Security Update : MySQL (SAT Patch Number 2317)

NASL family	Databases
NASL id	MYSQL_5_1_41.NASL
description	The version of MySQL 5.1 installed on the remote host is earlier than 5.1.41 and is, therefore, potentially affected by the following vulnerabilities : - An incomplete fix was provided in 5.1.24 for CVE-2008-2079, a symlink-related privilege escalation issue. (Bug #39277) - MySQL clients linked against OpenSSL are vulnerable to man-in-the-middle attacks. (Bug #47320) - The GeomFromWKB() function can be manipulated to cause a denial of service. (Bug #47780) - Specially crafted SELECT statements containing sub- queries in the WHERE clause can cause the server to crash. (Bug #48291)
last seen	2020-06-01
modified	2020-06-02
plugin id	42900
published	2009-11-25
reporter	This script is Copyright (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/42900
title	MySQL 5.1 < 5.1.41 Multiple Vulnerabilities

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20100216_MYSQL_ON_SL5_X.NASL
description	CVE-2009-4019 mysql: DoS (crash) when comparing GIS items from subquery and when handling subqueires in WHERE and assigning a SELECT result to a @variable CVE-2009-4028 mysql: client SSL certificate verification flaw CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098 It was discovered that the MySQL client ignored certain SSL certificate verification errors when connecting to servers. A man-in-the-middle attacker could use this flaw to trick MySQL clients into connecting to a spoofed MySQL server. (CVE-2009-4028) Note: This fix may uncover previously hidden SSL configuration issues, such as incorrect CA certificates being used by clients or expired server certificates. This update should be carefully tested in deployments where SSL connections are used. A flaw was found in the way MySQL handled SELECT statements with subqueries in the WHERE clause, that assigned results to a user variable. A remote, authenticated attacker could use this flaw to crash the MySQL server daemon (mysqld). This issue only caused a temporary denial of service, as the MySQL daemon was automatically restarted after the crash. (CVE-2009-4019) When the
last seen	2020-06-01
modified	2020-06-02
plugin id	60736
published	2012-08-01
reporter	This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/60736
title	Scientific Linux Security Update : mysql on SL5.x i386/x86_64

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2009-13466.NASL
description	- Update to MySQL 5.1.41, for various fixes described at http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html including security fixes - Stop waiting during
last seen	2020-06-01
modified	2020-06-02
plugin id	43374
published	2009-12-22
reporter	This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/43374
title	Fedora 12 : mysql-5.1.41-2.fc12 (2009-13466)

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2010-012.NASL
description	Multiple vulnerabilities has been found and corrected in mysql : mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement (CVE-2009-4019). The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library (CVE-2009-4028). MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079 (CVE-2009-4030). The updated packages have been patched to correct these issues. Additionally for 2009.1 and 2010.0 mysql has also been upgraded to the latest stable 5.1 release (5.1.42).
last seen	2020-06-01
modified	2020-06-02
plugin id	48166
published	2010-07-30
reporter	This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/48166
title	Mandriva Linux Security Advisory : mysql (MDVSA-2010:012)

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201201-02.NASL
description	The remote host is affected by the vulnerability described in GLSA-201201-02 (MySQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in MySQL. Please review the CVE identifiers referenced below for details. Impact : An unauthenticated remote attacker may be able to execute arbitrary code with the privileges of the MySQL process, cause a Denial of Service condition, bypass security restrictions, uninstall arbitrary MySQL plugins, or conduct Man-in-the-Middle and Cross-Site Scripting attacks. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	57446
published	2012-01-06
reporter	This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/57446
title	GLSA-201201-02 : MySQL: Multiple vulnerabilities

NASL family	Databases
NASL id	MYSQL_5_0_88.NASL
description	The version of MySQL 5.0 installed on the remote host is earlier than 5.0.88. It is, therefore, potentially affected by the following vulnerabilities : - MySQL clients linked against OpenSSL are vulnerable to man-in-the-middle attacks. (Bug #47320) - The GeomFromWKB() function can be manipulated to cause a denial of service. (Bug #47780) - Specially crafted SELECT statements containing sub- queries in the WHERE clause can cause the server to crash. (Bug #48291) - It is possible to bypass access restrictions when the data directory contains a symbolic link to a different file system. (Bug #39277)
last seen	2020-06-01
modified	2020-06-02
plugin id	42899
published	2009-11-25
reporter	This script is Copyright (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/42899
title	MySQL 5.0 < 5.0.88 Multiple Vulnerabilities

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2009-13504.NASL
description	- Update to MySQL 5.1.41, for various fixes described at http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html including security fixes - Stop waiting during
last seen	2020-06-01
modified	2020-06-02
plugin id	43375
published	2009-12-22
reporter	This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/43375
title	Fedora 11 : mysql-5.1.41-2.fc11 (2009-13504)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_1_LIBMYSQLCLIENT-DEVEL-091216.NASL
description	This update fixes several security issues in mysql : - checking server certificates (CVE-2009-4028) - error handling in subqueries (CVE-2009-4019) - preserving null_value flag in GeomFromWKB (CVE-2009-4019) - symlink behavior fixed (CVE-2008-7247) - symlink behavior refixed (CVE-2009-4030)
last seen	2020-06-01
modified	2020-06-02
plugin id	46219
published	2010-05-04
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/46219
title	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_1_LIBMYSQLCLIENT-DEVEL-100401.NASL
description	Updated mysql packages fix the following bugs : - upstream #47320 - checking server certificates (CVE-2009-4028) - upstream #48291 - error handling in subqueries (CVE-2009-4019) - upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) - upstream #39277 - symlink behaviour fixed (CVE-2008-7247) - upstream #32167 - symlink behaviour refixed (CVE-2009-4030)
last seen	2020-06-01
modified	2020-06-02
plugin id	46232
published	2010-05-05
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/46232
title	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2010-0109.NASL
description	From Red Hat Security Advisory 2010:0109 : Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. It was discovered that the MySQL client ignored certain SSL certificate verification errors when connecting to servers. A man-in-the-middle attacker could use this flaw to trick MySQL clients into connecting to a spoofed MySQL server. (CVE-2009-4028) Note: This fix may uncover previously hidden SSL configuration issues, such as incorrect CA certificates being used by clients or expired server certificates. This update should be carefully tested in deployments where SSL connections are used. A flaw was found in the way MySQL handled SELECT statements with subqueries in the WHERE clause, that assigned results to a user variable. A remote, authenticated attacker could use this flaw to crash the MySQL server daemon (mysqld). This issue only caused a temporary denial of service, as the MySQL daemon was automatically restarted after the crash. (CVE-2009-4019) When the
last seen	2020-06-01
modified	2020-06-02
plugin id	67997
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/67997
title	Oracle Linux 5 : mysql (ELSA-2010-0109)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_0_LIBMYSQLCLIENT-DEVEL-100504.NASL
description	Updated mysql packages fix the following bugs : - upstream #47320 - checking server certificates (CVE-2009-4028) - upstream #48291 - error handling in subqueries (CVE-2009-4019) - upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) - upstream #39277 - symlink behaviour fixed (CVE-2008-7247) - upstream #32167 - symlink behaviour refixed (CVE-2009-4030)
last seen	2020-06-01
modified	2020-06-02
plugin id	46229
published	2010-05-05
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/46229
title	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)

Oval

accepted

2013-04-29T04:10:07.658-04:00

class

vulnerability

contributors

name Aharon Chernin
organization SCAP.com, LLC
name Dragos Prisaca
organization G2, Inc.

definition_extensions

comment The operating system installed on the system is Red Hat Enterprise Linux 5
oval oval:org.mitre.oval:def:11414
comment The operating system installed on the system is CentOS Linux 5.x
oval oval:org.mitre.oval:def:15802
comment Oracle Linux 5.x
oval oval:org.mitre.oval:def:15459

description

family

unix

oval:org.mitre.oval:def:10940

status

accepted

submitted

2010-07-09T03:56:16-04:00

title

version

accepted

2013-09-23T04:05:40.469-04:00

class

vulnerability

contributors

name J. Daniel Brown
organization DTCC
name Maria Kedovskaya
organization ALTX-SOFT

definition_extensions

comment MySQL 5.0 is installed
oval oval:org.mitre.oval:def:8282
comment MySQL 5.1 is installed
oval oval:org.mitre.oval:def:8297

description

family

windows

oval:org.mitre.oval:def:8510

status

accepted

submitted

2010-01-22T17:00:00.000-05:00

title

MySQL 5.0 and 5.1 Clients with OpenSSL Vulnerability Allows Bypassing Server Certificate Checking

version

Redhat

advisories

rhsa

id	RHSA-2010:0109

rpms

mysql-0:5.0.77-4.el5_4.2
mysql-bench-0:5.0.77-4.el5_4.2
mysql-debuginfo-0:5.0.77-4.el5_4.2
mysql-devel-0:5.0.77-4.el5_4.2
mysql-server-0:5.0.77-4.el5_4.2
mysql-test-0:5.0.77-4.el5_4.2

Seebug

bulletinFamily	exploit
description	BUGTRAQ ID: 37076 CVE ID: CVE-2009-4028 MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。在使用OpenSSL的时候，MySQL的viosslfactories.c文件中的vio_verify_callback函数可以接受深度为0的X.509证书： vio_verify_callback() at viosslfactories.c: /* Approve cert if depth is greater then "verify_depth", currently verify_depth is always 0 and there is no way to increase it. */ if (verify_depth >= depth) ok= 1; 提供了特制证书的基于SSL MySQL数据库可以执行中间人攻击。 MySQL AB MySQL 5.1.x MySQL AB MySQL 5.0.x 厂商补丁： MySQL AB -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://lists.mysql.com/commits/87446
id	SSV:15006
last seen	2017-11-19
modified	2009-12-02
published	2009-12-02
reporter	Root
title	MySQL OpenSSL客户端绕过yaSSL服务器证书验证漏洞

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Oval

Redhat

Seebug

References