full-disclosure - rPSA-2006-0089-1 mysql mysql-bench mysql-server

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200606011905.k51J5X7A016024@lambchop.rdu.rpath.com>
Date: Thu Jun  1 20:05:46 2006
From: jmforbes at rpath.com (Justin M. Forbes)
Subject: rPSA-2006-0089-1 mysql mysql-bench mysql-server

rPath Security Advisory: 2006-0089-1
Published: 2006-06-01
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
    Local System User Deterministic Vulnerability
Updated Versions:
    mysql=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1
    mysql-bench=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1
    mysql-server=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2753
    http://issues.rpath.com/browse/RPL-396
    http://lists.mysql.com/announce/364

Description:
    Previous versions of mysql server and client libraries contain
    weaknesses parsing certain character encodings (such as SJIS,
    BIG5 and GBK, but not ASCII) which, when using the vulnerable
    encodings, can enable SQL injection attacks against applications
    (particularly web applications) which use non-standard escaping of
    quote characters.
    
    Because vulnerable escaping of quote characters is no longer allowed,
    some existing applications may not function correctly when used with
    the new release of mysql.