Bug 62135 (CVE-2004-0957)

Summary: VUL-0: CVE-2004-0957: several mysql bugs
Product: [Novell Products] SUSE Security Incidents Reporter: Thomas Biege <thomas>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P3 - Medium CC: kukuk, mls, patch-request, ro, security-team
Version: unspecified   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: CVE-2004-0957: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:NVD:CVE-2004-0381:2.1:(AV:L/AC:L/Au:N/C:N/I:P/A:N)
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: mysql-3.23.58-symlink.patch

Description Sebastian Krahmer 2004-10-12 17:35:22 UTC 
Hi,

There are several bugs in mysql which debian seems to have fixed.
Is this also an issue for us?

http://www.nl.debian.org/security/2004/dsa-562
Comment 1 Sebastian Krahmer 2004-10-12 17:35:22 UTC 
<!-- SBZ_reproduce  -->
...
Comment 2 Tomas Crhak 2004-10-19 02:03:05 UTC 
fixed packages submitted for SL 8.1, 8.2, 9.0 and 9.1
Comment 3 Marcus Meissner 2004-10-19 16:17:39 UTC 
Can ids: 
 
On 2004-10-14 Martin Schulze wrote:                                              
> I have now received two more CVE Ids for the other two vulnerabilities that    
> weren't fixed in our stable release.                                           
>                                                                                
> If you have a good channel to the upstream developers, please tell them        
> about the CVE IDs and ask them to add a note to their bug tracking system      
> that an id was assigned to a particular issue.                                 
                                                                                 
 [some text removed]                                                             
                                                                                 
> > > Crash with MATCH..AGAINST                                                  
> > >   Bug: #3870                                                               
CAN-2004-0956                                                                    
                                                                                 
> > > Privilege Escalation in ALTER TABLE RENAME                                 
> > >   Bug: #3270                                                               
CAN-2004-0835                                                                    
                                                                                 
> > > Potential Memory Overrun With Compromised DNS Server                       
> > >   Class: Denial of Service (crash but not exploitable with glibc they      
> > >   claim) Bug: #4017                                                        
CAN-2004-0836                                                                    
                                                                                 
> > > Privilege Escalation on GRANT ALL ON `Foo\_Bar`                            
> > >   Bug: #3933                                                               
CAN-2004-0957                                                                    
                                                                                 
> > > Concurrent accesses to MERGE tables can result in crash                    
> > >   Bug: #2408                                                               
CAN-2004-0837
Comment 4 Marcus Meissner 2004-10-19 23:42:45 UTC 
-> incident manager ... for laufzettel creation
Comment 5 Ludwig Nussel 2004-10-20 00:10:18 UTC 
the fixes for CAN-2004-0957 and CAN-2004-0956 are missing AFAICS. The Mail 
from Martin Schulze originally included: 
 
> Crash with MATCH..AGAINST (denial of service) 
>  
>     http://bugs.mysql.com/bug.php?id=3870 
>  
>     Only affects mysql 4.0 
>  
> Privilege Escalation on GRANT ALL ON `Foo\_Bar` 
>  
>     Changelog: 
>     Fixed bug in privilege checking where, under some conditions, one 
>     was able to grant privileges on the database, he has no privileges on. 
>  
>     http://bugs.mysql.com/bug.php?id=3933 
>     http://mysql.bkbits.net:8080/mysql-4.0/patch@1.1844.5.1 
>  
>     Does not only affect older versions than 4.0 as well.
Comment 6 Tomas Crhak 2004-10-21 02:06:19 UTC 
I suggest refusing the submitted packages. I will submit new ones with the last
two issues fixed.
Comment 7 Ludwig Nussel 2004-10-21 20:49:00 UTC 
Created attachment 25268 [details]
mysql-3.23.58-symlink.patch

while you are already at it ... I just saw that redhat has patched some tmp
file bugs (CAN-2004-0381 and CAN-2004-0388).
Comment 8 Tomas Crhak 2004-10-26 00:11:26 UTC 
The packages are prepared (including comment #7). I'll submit them as soon as
the incomplete ones have been rejected (and removed from /work/src/done).
Comment 9 Marcus Meissner 2004-10-26 00:47:08 UTC 
copy them to mysql.newer or remove the old ones yourself. ... 
 
if you can't, you or I can write a mail to autobuild@suse.de
Comment 10 Tomas Crhak 2004-10-26 16:21:05 UTC 
Done
Comment 11 Thomas Biege 2004-10-26 17:27:05 UTC 
<!-- SBZ_reopen -->Reopened by thomas@suse.de at Tue Oct 26 11:27:05 2004, took initial reporter krahmer@suse.de to cc
Comment 12 Thomas Biege 2004-10-26 17:27:05 UTC 
reopened for tracking.
Comment 13 Thomas Biege 2004-10-27 17:50:18 UTC 
/work/src/done/PATCHINFO/mysql.patch.maintained 
/work/src/done/PATCHINFO/mysql.patch.box
Comment 14 Marcus Meissner 2004-10-29 19:48:25 UTC 
i fixed the 9.1 checkin and submitted packages. 
It did not build due to one superflous hunk in symlink.patch
Comment 15 Tomas Crhak 2004-10-29 19:56:48 UTC 
I've fixed it as well right now ;-) Thanks anyway.
Comment 17 Thomas Biege 2004-11-19 23:00:26 UTC 
packages approved
Comment 18 Thomas Biege 2009-10-13 19:52:59 UTC 
CVE-2004-0957: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)