Test ID:	1.3.6.1.4.1.25623.1.0.56788
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1071-1)
Summary:	The remote host is missing an update for the Debian 'mysql' package(s) announced via the DSA-1071-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'mysql' package(s) announced via the DSA-1071-1 advisory. Vulnerability Insight: Several vulnerabilities have been discovered in MySQL, a popular SQL database. The Common Vulnerabilities and Exposures Project identifies the following problems: CVE-2006-0903 Improper handling of SQL queries containing the NULL character allows local users to bypass logging mechanisms. CVE-2006-1516 Usernames without a trailing null byte allow remote attackers to read portions of memory. CVE-2006-1517 A request with an incorrect packet length allows remote attackers to obtain sensitive information. CVE-2006-1518 Specially crafted request packets with invalid length values allow the execution of arbitrary code. The following vulnerability matrix shows which version of MySQL in which distribution has this problem fixed: woody sarge sid mysql 3.23.49-8.15 n/a n/a mysql-dfsg n/a 4.0.24-10sarge2 n/a mysql-dfsg-4.1 n/a 4.1.11a-4sarge3 n/a mysql-dfsg-5.0 n/a n/a 5.0.21-3 We recommend that you upgrade your mysql packages. Affected Software/OS: 'mysql' package(s) on Debian 3.0. Solution: Please install the updated package(s). CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2006-0903 1015693 http://securitytracker.com/id?1015693 16850 http://www.securityfocus.com/bid/16850 19034 http://secunia.com/advisories/19034 19502 http://secunia.com/advisories/19502 19814 http://secunia.com/advisories/19814 20060225 mysql <= 5.0.18 http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0653.html 20241 http://secunia.com/advisories/20241 20253 http://secunia.com/advisories/20253 20333 http://secunia.com/advisories/20333 20625 http://secunia.com/advisories/20625 30351 http://secunia.com/advisories/30351 ADV-2006-0752 http://www.vupen.com/english/advisories/2006/0752 DSA-1071 http://www.debian.org/security/2006/dsa-1071 DSA-1073 http://www.debian.org/security/2006/dsa-1073 DSA-1079 http://www.debian.org/security/2006/dsa-1079 MDKSA-2006:064 http://www.mandriva.com/security/advisories?name=MDKSA-2006:064 RHSA-2006:0544 http://www.redhat.com/support/errata/RHSA-2006-0544.html RHSA-2007:0083 http://www.redhat.com/support/errata/RHSA-2007-0083.html RHSA-2008:0364 http://www.redhat.com/support/errata/RHSA-2008-0364.html USN-274-1 https://usn.ubuntu.com/274-1/ USN-274-2 http://www.ubuntu.com/usn/usn-274-2 http://bugs.mysql.com/bug.php?id=17667 http://rst.void.ru/papers/advisory39.txt mysql-query-log-bypass-security(24966) https://exchange.xforce.ibmcloud.com/vulnerabilities/24966 oval:org.mitre.oval:def:9915 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9915 Common Vulnerability Exposure (CVE) ID: CVE-2006-1516 http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html BugTraq ID: 17780 http://www.securityfocus.com/bid/17780 Bugtraq: 20060502 MySQL Anonymous Login Handshake - Information Leakage. (Google Search) http://www.securityfocus.com/archive/1/432733/100/0/threaded Bugtraq: 20060516 UPDATE: [ GLSA 200605-13 ] MySQL: Information leakage (Google Search) http://www.securityfocus.com/archive/1/434164/100/0/threaded Cert/CC Advisory: TA07-072A http://www.us-cert.gov/cas/techalerts/TA07-072A.html Debian Security Information: DSA-1071 (Google Search) Debian Security Information: DSA-1073 (Google Search) Debian Security Information: DSA-1079 (Google Search) http://www.gentoo.org/security/en/glsa/glsa-200605-13.xml http://www.mandriva.com/security/advisories?name=MDKSA-2006:084 http://www.wisec.it/vulns.php?page=7 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9918 http://securitytracker.com/id?1016017 http://secunia.com/advisories/19929 http://secunia.com/advisories/20002 http://secunia.com/advisories/20073 http://secunia.com/advisories/20076 http://secunia.com/advisories/20223 http://secunia.com/advisories/20424 http://secunia.com/advisories/20457 http://secunia.com/advisories/20762 http://secunia.com/advisories/24479 http://secunia.com/advisories/29847 http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.599377 http://securityreason.com/securityalert/840 http://sunsolve.sun.com/search/document.do?assetkey=1-26-236703-1 SuSE Security Announcement: SUSE-SA:2006:036 (Google Search) http://lists.suse.com/archive/suse-security-announce/2006-Jun/0011.html SuSE Security Announcement: SUSE-SR:2006:012 (Google Search) http://www.novell.com/linux/security/advisories/2006-06-02.html http://www.trustix.org/errata/2006/0028 https://usn.ubuntu.com/283-1/ http://www.vupen.com/english/advisories/2006/1633 http://www.vupen.com/english/advisories/2007/0930 http://www.vupen.com/english/advisories/2008/1326/references XForce ISS Database: mysql-login-packet-info-disclosure(26236) https://exchange.xforce.ibmcloud.com/vulnerabilities/26236 Common Vulnerability Exposure (CVE) ID: CVE-2006-1517 Bugtraq: 20060502 MySQL COM_TABLE_DUMP Information Leakage and Arbitrary commandexecution. (Google Search) http://www.securityfocus.com/archive/1/432734/100/0/threaded http://www.wisec.it/vulns.php?page=8 http://www.osvdb.org/25228 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11036 http://securitytracker.com/id?1016016 http://securityreason.com/securityalert/839 XForce ISS Database: mysql-sqlparcecc-information-disclosure(26228) https://exchange.xforce.ibmcloud.com/vulnerabilities/26228 Common Vulnerability Exposure (CVE) ID: CVE-2006-1518 CERT/CC vulnerability note: VU#602457 http://www.kb.cert.org/vuls/id/602457 XForce ISS Database: mysql-comtabledump-bo(26232) https://exchange.xforce.ibmcloud.com/vulnerabilities/26232
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.