We received the following report via vendor-sec.
This issue is not public yet, please keep any information about it inside SUSE.

Is this script used by some automatism? If not it's sufficient to
fix this with the next mysql security update IMO (if there is one).

Date: Thu, 13 Jan 2005 12:20:35 +0100
From: Martin Schulze <joey@infodrom.org>
To: vendor-sec@lst.de
Subject: [vendor-sec] CAN-2005-0004: Insecure temporary file use in mysql

Javier Fernandez-Sanguino Pena from the Debian Security Audit Project
discoverd a temporary file vulnerability in the mysqlaccess script of
MySQL that could allow an unprivileged user to let root overwrite
arbitrary files via a symlink attack and could also could unveil the
contents of a temporary file which might contain sensitive
information.

Below please find the proposed patch by Javier.

Thanks to Mark for providing a CVE id.

This problem went public without our intention by MySQL already:
http://lists.mysql.com/internals/20600

Regards,

	Joey