Test ID:	1.3.6.1.4.1.25623.1.0.50513
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDKSA-2004:034 (MySQL)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to MySQL announced via advisory MDKSA-2004:034. Shaun Colley discovered that two scripts distributed with MySQL, the 'mysqld_multi' and 'mysqlbug' scripts, did not create temporary files in a secure fashion. An attacker could create symbolic links in /tmp that could allow for overwriting of files with the privileges of the user running the scripts. The scripts have been patched in the updated packages to prevent this behaviour. Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2004:034 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0381 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0388 Risk factor : Medium CVSS Score: 2.1
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2004-0381 BugTraq ID: 9976 http://www.securityfocus.com/bid/9976 Bugtraq: 20040324 mysqlbug tmpfile/symlink vulnerability. (Google Search) http://marc.info/?l=bugtraq&m=108023246916294&w=2 Bugtraq: 20040414 [OpenPKG-SA-2004.014] OpenPKG Security Advisory (mysql) (Google Search) http://marc.info/?l=bugtraq&m=108206802810402&w=2 Computer Incident Advisory Center Bulletin: P-018 http://www.ciac.org/ciac/bulletins/p-018.shtml Debian Security Information: DSA-483 (Google Search) http://www.debian.org/security/2004/dsa-483 http://security.gentoo.org/glsa/glsa-200405-20.xml http://www.mandriva.com/security/advisories?name=MDKSA-2004:034 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11557 http://www.redhat.com/support/errata/RHSA-2004-569.html http://www.redhat.com/support/errata/RHSA-2004-597.html XForce ISS Database: mysql-mysqlbug-symlink(15617) https://exchange.xforce.ibmcloud.com/vulnerabilities/15617 Common Vulnerability Exposure (CVE) ID: CVE-2004-0388 BugTraq ID: 10142 http://www.securityfocus.com/bid/10142 http://www.osvdb.org/6421 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10559 http://securitytracker.com/id?1009784 http://secunia.com/advisories/11223/ XForce ISS Database: mysql-mysqldmulti-symlink(15883) https://exchange.xforce.ibmcloud.com/vulnerabilities/15883
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.