bugtraq - GLSA: mysql (200303-14)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20030318181218.284175764@mail2.tamperd.net>
Date: Tue, 18 Mar 2003 19:12:56 +0100
From: Daniel Ahlberg <aliz@...too.org>
To: bugtraq@...urityfocus.com
Subject: GLSA:  mysql (200303-14)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200303-14
- - ---------------------------------------------------------------------

          PACKAGE : mysql
          SUMMARY : remote root exploit
             DATE : 2003-03-18 18:12 UTC
          EXPLOIT : remote
VERSIONS AFFECTED : <3.23.56
    FIXED VERSION : >=3.23.56
              CVE : 

- - ---------------------------------------------------------------------

"This issue has been adressed in 3.23.56 (release build is started
today), and some steps were taken to alleviate the threat.

In particular, MySQL will no longer read config files that are
world-writeable (and SELECT ... OUTFILE always creates world-writeable
files). Also, unlike other options, for --user option the first one will
have the precedence. So if --user is set in /etc/my.cnf (as it is
recommended in the manual), datadir/my.cnf will not be able to override
it."

quote from:
http://marc.theaimsgroup.com/?l=bugtraq&m=104739810523433&w=2

SOLUTION

It is recommended that all Gentoo Linux users who are running
dev-db/mysql upgrade to mysql-3.23.56 as follows:

emerge sync
emerge mysql
emerge clean

- - ---------------------------------------------------------------------
aliz@...too.org - GnuPG key is available at http://cvs.gentoo.org/~aliz
- - ---------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+d2GffT7nyhUpoZMRAiDNAJ9CABOwtIrF3njTkLBxCO2SdvtsugCeMqqH
SSeumvMyzTQCfb0/C4I1nIU=
=HMcb
-----END PGP SIGNATURE-----