[mysql] multiple vulnerabilities

[disabled.user]

References:
[1] DSA-1413-1 (http://www.debian.org/security/2007/dsa-1413)
[2] Bug#163811

Quoting [1]:
"Several vulnerabilities have been found in the MySQL database packages
with implications ranging from unauthorized database modifications to
remotely triggered server crashes."

[disabled.user (disabled.user-deactivatedaccount)]

Accidently chosen tuXlab instead of Ubuntu (!§$"§$ mousewheel...).

[disabled.user (disabled.user-deactivatedaccount)]

See also:
MDKSA-2007:243 (http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:243)

[Jamie Strandboge (jdstrand)]

For mysql-dfsg-5.0, the following are fixed in Dapper - Hardy (http://www.ubuntu.com/usn/usn-528-1):
CVE-2007-2583
CVE-2007-2691
CVE-2007-3780
CVE-2007-3782

And these are fixed in Gutsy and Hardy:
CVE-2007-2692
CVE-2007-3781

[Jamie Strandboge (jdstrand)]

Updates for CVE-2007-3781, CVE-2007-5925, CVE-2007-5969 are committed.

This leaves CVE-2007-2692 for Dapper -> Feisty

[Jamie Strandboge (jdstrand)]

Updates are now released for the above CVEs.

Let's leave this bug open for CVE-2007-2692, but please file future CVEs in new reports.

[Jamie Strandboge (jdstrand)]

http://www.ubuntu.com/usn/usn-559-1

[Jamie Strandboge (jdstrand)]

STATUS UPDATE

CVE-2007-2692 is not fixed in Debian Etch (and therefore the patch can't be used in Ubuntu releases). DSA-1413 omits part of the patch to sql/sql_db.cc and the test cases. If use the test cases from http://lists.mysql.com/commits/23650 against Etch, then it shows that Etch is still vulnerable. MDKSA-2007:243 does not address CVE-2007-2692. Investigating proper fix.

[Jamie Strandboge (jdstrand)]

This fix is part of a larger update and is available in -proposed. Please test and report results in bug #201009.

[Launchpad Janitor (janitor)]

This bug was fixed in the package mysql-dfsg-5.0 - 5.0.38-0ubuntu1.4

---------------
mysql-dfsg-5.0 (5.0.38-0ubuntu1.4) feisty-security; urgency=low

  * no change build for -security upload

mysql-dfsg-5.0 (5.0.38-0ubuntu1.3) feisty-proposed; urgency=low

  * SECURITY UPDATE: buffer overflow via ProcessOldClientHello() in
    handshake.cpp and input_buffer& operator>> in yassl_imp.cpp
  * SECURITY UPDATE: buffer overread in HASHwithTransform::Update in hash.cpp
  * debian/patches/97_SECURITY_CVE-2008-0226_0227.dpatch: properly verify
    length of input (LP: #186978).
  * SECURITY UPDATE: privilege escalation via crafted CREATE SQL SECURITY
    DEFINER VIEW and ALTER VIEW statements
  * debian/patches/98_SECURITY_CVE-2007-6303.dpatch: make sure lex->definer
    is non-NULL in sql_view.cc (LP: #185039)
  * debian/patches/99_view_fix-now.dpatch: update view.test and view.result to
    use a static year instead of now(). These tests are not part of the build
    but helps with qa-regression-testing
  * SECURITY UPDATE: privilege escalation via SQL SECURITY INVOKER stored
    routines
  * debian/patches/100_SECURITY_CVE-2007-2692.dpatch: restore THD::db_access
    when returning from stored routine by performing privilege checks in the
    execution stage rather than the parsing stage. (LP: #172260)
  * References
    CVE-2008-0226
    CVE-2008-0227
    CVE-2007-6303
    CVE-2007-2692
    http://bugs.mysql.com/bug.php?id=27337

 -- Jamie Strandboge <email address hidden> Wed, 19 Mar 2008 15:17:20 -0400

[Jamie Strandboge (jdstrand)]

http://www.ubuntu.com/usn/usn-588-1

[Hew (hew)]

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

[Saivann Carignan (oxmosys)]

Dapper is not supported anymore since July 2009, therefore I mark Dapper status to invalid.