Technical Description

Multiple vulnerabilities were identified in MySQL, which could be exploited by malicious users to execute arbitrary commands or cause a denial of service.

The first issue is due to an input validation error when processing requests containing backslash characters "\", which could be exploited by malicious users to conduct directory traversal attacks. Exploitation would require the ability to create user-defined functions.

The second flaw is due to buffer overflow error in the "init_syms()" function when processing specially crafted function names, which could be exploited by malicious users to execute arbitrary commands. Exploitation would require the ability to create user-defined functions.

The third vulnerability is due to an error when loading invalid library files, which could be exploited by malicious users (with insert privileges) to cause a denial of service.

The fourth issue is due to an error where MySQL fails to filter execution of arbitrary libraries, which could be exploited by malicious users to load arbitrary libraries/functions and overwrite arbitrary memory locations. Exploitation would require the ability to create user-defined functions.

The fifth flaw is due to errors when handling a query with multiupdate and subselects, which could be exploited by attackers to cause a denial of service.

Affected Products

MySQL versions prior to 4.0.25
MySQL versions prior to 4.1.13
MySQL versions prior to 5.0.7-beta

Solution

Upgrade to MySQL versions 4.0.25, 4.1.13, or 5.0.7-beta :
http://dev.mysql.com/downloads/

References

http://www.vupen.com/english/advisories/2005/1343
http://www.appsecinc.com/resources/alerts/mysql/2005-001.html
http://www.appsecinc.com/resources/alerts/mysql/2005-002.html
http://www.appsecinc.com/resources/alerts/mysql/2005-003.html

Credits

Vulnerabilities reported by Reid Borsuk

ChangeLog

2005-08-09 : Initial release
2006-09-03 : Updated Description

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.