=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2008/VULN268
_____________________________________________________________________

DATE                      : 02/07/2008

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Solaris 10 running with MySQL 4.0.x.

======================================================================
http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-66-236703-1
______________________________________________________________________

    Solution Type: Sun Alert
    Solution  236703 :   Multiple Security Vulnerabilities May Affect
    MySQL 4.0.x Bundled With Solaris 10
    Bug ID: 6686179

    Product
    Solaris 10 Operating System

    Date of Preliminary Release: 21-Apr-2008

    Date of Resolved Release: 30-Jun-2008

    SA Document Body
    Multiple Security Vulnerabilities in MySQL 4.0.x (see below for details)

    1. Impact

    Multiple security vulnerabilities in the "MySQL" package, an open
    source database package bundled with Solaris 10 (see mysqld(1)), may
    result in one or more of the following issues:
    1. A stack-based buffer overflow in the "init_syms" function in MySQL
    4.0 prior to 4.0.25 may allow a remote authenticated users with the
    ability to create user-defined functions to execute arbitrary code via
    a long "function_name"  field.  For additional information see:
      * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2558

    2.  The "check_connection" function in sql_parse.cc in MySQL 4.0.x
    through 4.0.26 may allow  a remote unauthorized users to read portions
    of memory via a username without a trailing null byte.  This may
    result in a buffer over-read. For additional information see:
      * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1516

    3. "sql_parse.cc"  in MySQL 4.0.x through 4.0.26 may allow a remote
    unauthorized users to obtain sensitive information via a
    "COM_TABLE_DUMP" request with an incorrect packet length that
    includes portions of memory in an error message. For additional
    information see:
      * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1517

    2. Contributing Factors

    These issues can occur in the following :
    SPARC Platform
      * Solaris 10 without patch 120292-02

    x86 Platform
      * Solaris 10 without patch 120293-02

    Note: Solaris 8 and Solaris 9 are not impacted by these issues.
    In order for a system to be vulnerable to the issues mentioned above,
    (with the exception of  issue number 3),  the "MySQL" server daemon
    (mysqld(1)) must be running on the system. To determine if the "MySQL"
    server daemon is running on the system, the following command can be
    executed:
        $ pgrep -lf mysqld || echo "System is not affected."
        107098 /usr/sfw/sbin/mysqld

    3. Symptoms

    There are no predictable symptoms that would indicate the described
    issues have been exploited.

    4. Workaround

    There is no workaround for these issues.

    5. Resolution

    These issues is addressed in the following releases:
    SPARC Platform
      * Solaris 10 with patch 120292-02 or later

    x86 Platform
      * Solaris 10 with patch 120293-02 or later

    For more information on Security Sun Alerts, see Technical
    Instruction ID 213557
    This Sun Alert notification is being provided to you on an "AS IS"
    basis. This Sun Alert notification may contain information provided by
    third parties. The issues described in this Sun Alert notification may
    or may not impact your system(s). Sun makes no representations,
    warranties, or guarantees as to the information contained herein. ANY
    AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
    WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
    NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT
    YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
    INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE
    OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN.
    This Sun Alert notification contains Sun proprietary and confidential
    information. It is being provided to you pursuant to the provisions of
    your agreement to purchase services from Sun, or, if you do not have
    such an agreement, the Sun.com Terms of Use. This Sun Alert
    notification may only be used for the purposes contemplated by these
    agreements.
    Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa
    Clara, CA 95054 U.S.A. All rights reserved

======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================