| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <200310071915.49480.security-announce@turbolinux.co.jp>
From: security-announce at turbolinux.co.jp (Turbolinux)
Subject: [TURBOLINUX SECURITY INFO] 07/Oct/2003
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is an announcement only email list for the x86 architecture.
============================================================
Turbolinux Security Announcement 07/Oct/2003
============================================================
The following page contains the security information of Turbolinux Inc.
- Turbolinux Security Center
http://www.turbolinux.com/security/
(1) MySQL -> Buffer overflow
===========================================================
* MySQL -> Buffer overflow
===========================================================
More information :
MySQL is a true multi-user, multi-threaded SQL database server.
A buffer overrun condition exists in get_salt_from_password from sql_acl.cc.
Impact :
This vulnerability may allow an attacker with ALTER TABLE privileges to execute arbitrary code
via a long Password field.
Affected Products :
- Turbolinux 8 Server
- Turbolinux 8 Workstation
- Turbolinux 7 Server
- Turbolinux 7 Workstation
- Turbolinux Server 6.5
- Turbolinux Advanced Server 6
- Turbolinux Server 6.1
- Turbolinux Workstation 6.0
Solution :
Please use turbopkg(zabom) tool to apply the update.
---------------------------------------------
# turbopkg
or
# zabom update MySQL MySQL-bench MySQL-client MySQL-devel MySQL-shared
---------------------------------------------
<Turbolinux 8 Server>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/MySQL-3.23.58-1.src.rpm
12040644 87548b1f3a418ce5d95af38ed527e98e
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-3.23.58-1.i586.rpm
5055971 0bfb25a6a8a14b2cd510db8444ef84c8
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
612003 fa0d14181849da0e5982bda7a701a077
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
156004 4eb6c7ba8a27f4980924b53df141270c
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
1148777 478addc59f87d0c0be182a19fec06804
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
192871 bc2c8ac350cb836f5a2f76dd5fea983b
<Turbolinux 8 Workstation>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/MySQL-3.23.58-1.src.rpm
12040644 815ace4785452aad0ecd122c49805011
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-3.23.58-1.i586.rpm
5055683 54d4f8563763fa21d82edaf04fd584a5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
612023 a996aa237aee7aef7bee2d561950e25a
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
155961 68fcfdde1269122d124cd52631744178
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
1148969 4a36ecfd66131c666f75aad9942861f5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
192971 c061c321c5c1492d9c615fae03a4fbed
<Turbolinux 7 Server>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/MySQL-3.23.58-1.src.rpm
12040644 67f11e13192ac1690c296d1e67c4d924
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-3.23.58-1.i586.rpm
4973477 f9cca3469a07d93dcecbf22ae68ac9fe
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
613743 215472ced1ae456c938debe92dd77699
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
151767 0e5aafa1ca5c354a149ce95f067715f4
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
1086922 56a3b8937aa293f17a7b5da4cc3caba0
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
186170 e3aa7f2dc7c4e40e8bbb35f90f878e9e
<Turbolinux 7 Workstation>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/MySQL-3.23.58-1.src.rpm
12040644 ae4323e83c921a5d660ca3060466e8be
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-3.23.58-1.i586.rpm
4974234 f1f8c38b3d0b5d50f24eff1b35147e02
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
613498 352f389511656f14fc235615a6dbb8c6
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
151770 016b8bda6fb6c1bd897822ee97d6964e
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
1086071 15102c5b31fe5a5629de6141a25d21c9
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
186514 68ce0298c3eb12ba9c66853109a3a647
<Turbolinux Server 6.5>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/SRPMS/MySQL-3.23.58-1.src.rpm
12040644 490107b6fb28ce58c16300504be18d2e
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-3.23.58-1.i386.rpm
6150619 bef47369cb23199f71a967bcf81cc1a1
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-bench-3.23.58-1.i386.rpm
731247 bffe436a19b79482af2cb7f72e95c44c
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-client-3.23.58-1.i386.rpm
158946 d31b7dc62f7293d507518187316c896f
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-devel-3.23.58-1.i386.rpm
1329162 66eb677a05c5b3d49bfe2666181a5d72
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-shared-3.23.58-1.i386.rpm
256291 5a4607d6589a77bd0bfb6c1045cc9606
<Turbolinux Advanced Server 6>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/SRPMS/MySQL-3.23.58-1.src.rpm
12040644 5fc5593e97a455a4d5beb4e4e68c4517
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-3.23.58-1.i386.rpm
6150560 0df722bb008bc482147289caf60afc2a
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-bench-3.23.58-1.i386.rpm
731170 d819d6fe4392a78229c84594997de0aa
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-client-3.23.58-1.i386.rpm
158935 0999bdcda4373cbb5cba3f7bcdf865cb
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-devel-3.23.58-1.i386.rpm
1329155 f5722aff46e6a6c2cb446322f2db5901
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-shared-3.23.58-1.i386.rpm
256291 130be88f5aedb4d4bc0b94e4a7b668ce
<Turbolinux Server 6.1>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/SRPMS/MySQL-3.23.58-1.src.rpm
12040644 6d088306780a214b4e30bcc906c8483f
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-3.23.58-1.i386.rpm
6149243 c6d65524d3d19c0515438c6809ce084f
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-bench-3.23.58-1.i386.rpm
731171 86121adf1b602d7194dd90b626cdb0fd
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-client-3.23.58-1.i386.rpm
158947 5d54f7af88c4cc1ce95c683b737046fd
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-devel-3.23.58-1.i386.rpm
1329081 50c4b409fc4aec82e9fa832e18f821ab
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-shared-3.23.58-1.i386.rpm
256290 18ad33ceddd332200bbc7a14e6c062f9
References :
CVE
[CAN-2003-0780]
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0780
--------------------------------------------------------------------------
Revision History
07 Oct 2003 Initial release
--------------------------------------------------------------------------
* You may need to update the turbopkg tool before applying the update.
Please refer to the following URL for detailed information.
http://www.turbolinux.com/download/zabom.html
http://www.turbolinux.com/download/zabomupdate.html
Package Update Path
http://www.turbolinux.com/update
============================================================
* To obtain the public key
Here is the public key
http://www.turbolinux.com/security/
* To unsubscribe from the list
If you ever want to remove yourself from this mailing list,
you can send a message to <server-users-e-ctl@...bolinux.co.jp> with
the word `unsubscribe' in the body (don't include the quotes).
unsubscribe
* To change your email address
If you ever want to chage email address in this mailing list,
you can send a message to <server-users-e-ctl@...bolinux.co.jp> with
the following command in the message body:
chaddr 'old address' 'new address'
If you have any questions or problems, please contact
<supp_info@...bolinux.co.jp>
Thank you!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQE/gpJPK0LzjOqIJMwRAnOGAJ0ZhXnOLj0N1/rBOdcavBtyOeSvvwCcCdul
OOwQpxohzEPKqDkS/rrlcYY=
=BxgQ
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists