full-disclosure - rPSA-2006-0089-1 mysql mysql-bench mysql-server

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [month] [year] [list]

Date: Thu Jun  1 20:05:46 2006
From: jmforbes at rpath.com (Justin M. Forbes)
Subject: rPSA-2006-0089-1 mysql mysql-bench mysql-server

rPath Security Advisory: 2006-0089-1
Published: 2006-06-01
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
    Local System User Deterministic Vulnerability
Updated Versions:
    mysql=/conary.rpath.com@...:devel//1/5.0.22-1-0.1
    mysql-bench=/conary.rpath.com@...:devel//1/5.0.22-1-0.1
    mysql-server=/conary.rpath.com@...:devel//1/5.0.22-1-0.1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2753
    http://issues.rpath.com/browse/RPL-396
    http://lists.mysql.com/announce/364

Description:
    Previous versions of mysql server and client libraries contain
    weaknesses parsing certain character encodings (such as SJIS,
    BIG5 and GBK, but not ASCII) which, when using the vulnerable
    encodings, can enable SQL injection attacks against applications
    (particularly web applications) which use non-standard escaping of
    quote characters.
    
    Because vulnerable escaping of quote characters is no longer allowed,
    some existing applications may not function correctly when used with
    the new release of mysql.