-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1662-1 security@xxxxxxxxxx http://www.debian.org/security/ Devin Carraway November 06, 2008 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : mysql-dfsg-5.0 Vulnerability : authorization bypass Problem type : local Debian-specific: no CVE Id(s) : CVE-2008-4098 Debian Bug : 480292 A symlink traversal vulnerability was discovered in MySQL, a relational database server. The weakness could permit an attacker having both CREATE TABLE access to a database and the ability to execute shell commands on the database server to bypass MySQL access controls, enabling them to write to tables in databases to which they would not ordinarily have access. The Common Vulnerabilities and Exposures project identifies this vulnerability as CVE-2008-4098. Note that a closely aligned issue, identified as CVE-2008-4097, was prevented by the update announced in DSA-1608-1. This new update supercedes that fix and mitigates both potential attack vectors. For the stable distribution (etch), this problem has been fixed in version 5.0.32-7etch8. We recommend that you upgrade your mysql packages. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Debian (stable) - --------------- Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.32.orig.tar.gz Size/MD5 checksum: 16439441 f99df050b0b847adf7702b44e79ac877 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.32-7etch8.dsc Size/MD5 checksum: 1117 6456a5396b56431a31e2121805ef3208 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-dfsg-5.0_5.0.32-7etch8.diff.gz Size/MD5 checksum: 269277 bc749451446872ac8c8567ed60b0eea6 Architecture independent packages: http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server_5.0.32-7etch8_all.deb Size/MD5 checksum: 48142 761dce88bf46026622550e503800d4c3 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-common_5.0.32-7etch8_all.deb Size/MD5 checksum: 54452 64140dddeb7bd50098ddc6222b4d2939 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client_5.0.32-7etch8_all.deb Size/MD5 checksum: 46068 0a67c6a61d08bf716c0af68da1585563 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_alpha.deb Size/MD5 checksum: 8405572 ceda4648a1bbc48f087f8763350c04e7 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_alpha.deb Size/MD5 checksum: 27385278 b5435c8d77f64e1855300e1988570333 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_alpha.deb Size/MD5 checksum: 8909972 e76dc32887c4baf25721eff971aa9d60 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_alpha.deb Size/MD5 checksum: 48170 c6eb1472bb6cf4fad708c23dd9a78cf8 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_alpha.deb Size/MD5 checksum: 1947544 73d751f95dc5604d159df910a3157f45 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_amd64.deb Size/MD5 checksum: 1831314 6ed359b8f2fb92c5c9846a3743e4b0f8 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_amd64.deb Size/MD5 checksum: 7549266 ca948f5c66f2172927acd9e5cbf7c9ae http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_amd64.deb Size/MD5 checksum: 7371842 7ff54b963be65b5e7d18425cd313bbcb http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_amd64.deb Size/MD5 checksum: 48178 127af2553cc1fd9e89f1f69a2eb44709 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_amd64.deb Size/MD5 checksum: 25813464 06dc8568f055c04dc4ddfd19de79a704 arm architecture (ARM) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_arm.deb Size/MD5 checksum: 48230 2a5b1b7b2ed8c94301fc60bd49be7991 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_arm.deb Size/MD5 checksum: 7208004 9e268d05c77d521dbe0366961534cdf2 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_arm.deb Size/MD5 checksum: 25347882 b89ba96f815a27ebe70014d8c16e6bc0 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_arm.deb Size/MD5 checksum: 6930850 21ec3a8f5a6634454db8dec30fea9e65 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_arm.deb Size/MD5 checksum: 1748390 1877d302ebc91e8ccf104ba2d75479a6 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_hppa.deb Size/MD5 checksum: 27178846 d5b6eb3072bb2e8f2d114b182701a736 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_hppa.deb Size/MD5 checksum: 8060958 f4d89fec611eb37939d98f3e52391b21 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_hppa.deb Size/MD5 checksum: 48174 be34e4d2b05e4b294f5a3396611d4126 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_hppa.deb Size/MD5 checksum: 1920860 8ef8d38dc53e5f81eebcad330103062a http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_hppa.deb Size/MD5 checksum: 8003664 50496388e230ba0e337fadb5611c1bec i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_i386.deb Size/MD5 checksum: 1792994 2ee1e253198f7f67be79b40fbcee703a http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_i386.deb Size/MD5 checksum: 6961428 8be34f2ed518aa47148502b93e468ac0 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_i386.deb Size/MD5 checksum: 25233474 cf39de0d83a65da443fb77e37976d19b http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_i386.deb Size/MD5 checksum: 7199354 d144813e5cd27c684cb8ff45a987159e http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_i386.deb Size/MD5 checksum: 48166 2f4ab0db379d477d4ea15191a1ff4a7c ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_ia64.deb Size/MD5 checksum: 2115810 09e39bed782c6c2e7d689aa999adbfb1 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_ia64.deb Size/MD5 checksum: 10342902 c091c2d6b6f02d120b513f07ecada159 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_ia64.deb Size/MD5 checksum: 9739330 f158dd90752b99efe92bca049b991696 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_ia64.deb Size/MD5 checksum: 30403740 c3daa72e6e34c54f8053887a52395e36 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_ia64.deb Size/MD5 checksum: 48170 b9f94375cccf2cb2a3aff60b232b400b mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_mips.deb Size/MD5 checksum: 7674430 311032237de0d11e91d591b006ab6e60 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_mips.deb Size/MD5 checksum: 48214 0751225fd59fce147105362c6cc30b16 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_mips.deb Size/MD5 checksum: 7759738 74a1bd32b13f0c57f67100b6c0422d6e http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_mips.deb Size/MD5 checksum: 1835426 f425af4483842630558bdcaaba7ac1ee http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_mips.deb Size/MD5 checksum: 26472386 ed2e2a0eb36de7424d5bd03ab8f3b8f7 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_mipsel.deb Size/MD5 checksum: 25846914 766bcfbde62e9f75fc09f8892b1f6095 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_mipsel.deb Size/MD5 checksum: 7563074 fb084ab6a02dcf12fde22c740d6d63ac http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_mipsel.deb Size/MD5 checksum: 7642196 c58f251badf84dd7527f6bcf74bc1846 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_mipsel.deb Size/MD5 checksum: 48174 92fe38d06aac7ca0a1ff1a26f5858704 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_mipsel.deb Size/MD5 checksum: 1789960 0864b73e16d14ed1776879d3ef2ab5c1 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_powerpc.deb Size/MD5 checksum: 7575148 351f97505dde5ce74808b38008a04d1f http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_powerpc.deb Size/MD5 checksum: 7513654 5d9f12246f363b4eaab281e6c37ccf48 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_powerpc.deb Size/MD5 checksum: 26169508 81c25c622b35bec7d709f8fef4b3ba03 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_powerpc.deb Size/MD5 checksum: 48174 43cdd4b621fa97e345162fb5a11c3321 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_powerpc.deb Size/MD5 checksum: 1833008 a031cdc91532615006e3433ea1a2b9cc s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_s390.deb Size/MD5 checksum: 48172 b15d4493389f2d371d933b3cfec9dbfa http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_s390.deb Size/MD5 checksum: 7508416 7950a277db319634c2a61162c531d9f8 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_s390.deb Size/MD5 checksum: 1952408 4035d4b30041b76cdad65f5093d0191e http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_s390.deb Size/MD5 checksum: 26765686 38ad49284aa88c6157c496f5583e81b4 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_s390.deb Size/MD5 checksum: 7414890 b61ee866d423474e4e76e68527d09b31 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-client-5.0_5.0.32-7etch8_sparc.deb Size/MD5 checksum: 7159698 8ec6e96934ed76dbae21d28ebb701f02 http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-5.0_5.0.32-7etch8_sparc.deb Size/MD5 checksum: 25578698 e0cd9496cac89eb22ba854b3e10ca96b http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15-dev_5.0.32-7etch8_sparc.deb Size/MD5 checksum: 7028544 fa58c135613be17bd723fea6c4f4de0d http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/libmysqlclient15off_5.0.32-7etch8_sparc.deb Size/MD5 checksum: 1798226 b1a13379770a9b860a6328176c93eecd http://security.debian.org/pool/updates/main/m/mysql-dfsg-5.0/mysql-server-4.1_5.0.32-7etch8_sparc.deb Size/MD5 checksum: 48218 9e6c78e0ae63d91c3361ff106ca0d4a7 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFJEmvqU5XKDemr/NIRAtjFAKD0b1I33j80Z6JworeVVlNHKuW4yQCfVusE I5MOY2TVITMgVkkzs7IrQTw= =5+yr -----END PGP SIGNATURE-----
