Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2010:0110
The remote host is missing updates announced in
advisory RHSA-2010:0110.

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

Multiple flaws were discovered in the way MySQL handled symbolic links to
tables created using the DATA DIRECTORY and INDEX DIRECTORY directives in
CREATE TABLE statements. An attacker with CREATE and DROP table privileges
and shell access to the database server could use these flaws to escalate
their database privileges, or gain access to tables created by other
database users. (CVE-2008-4098, CVE-2009-4030)

Note: Due to the security risks and previous security issues related to the
use of the DATA DIRECTORY and INDEX DIRECTORY directives, users not
depending on this feature should consider disabling it by adding
symbolic-links=0 to the [mysqld] section of the my.cnf configuration
file. In this update, an example of such a configuration was added to the
default my.cnf file.

An insufficient HTML entities quoting flaw was found in the mysql command
line client's HTML output mode. If an attacker was able to inject arbitrary
HTML tags into data stored in a MySQL database, which was later retrieved
using the mysql command line client and its HTML output mode, they could
perform a cross-site scripting (XSS) attack against victims viewing the
HTML output in a web browser. (CVE-2008-4456)

Multiple format string flaws were found in the way the MySQL server logged
user commands when creating and deleting databases. A remote, authenticated
attacker with permissions to CREATE and DROP databases could use these
flaws to formulate a specially-crafted SQL command that would cause a
temporary denial of service (open connections to mysqld are terminated).

Note: To exploit the CVE-2009-2446 flaws, the general query log (the mysqld
--log command line option or the log option in my.cnf) must be
enabled. This logging is not enabled by default.

All MySQL users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. After installing this
update, the MySQL server daemon (mysqld) will be restarted automatically.

Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

Risk factor : Critical

CVSS Score:

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2008-4098
Debian Security Information: DSA-1662 (Google Search)
SuSE Security Announcement: SUSE-SR:2008:025 (Google Search)
XForce ISS Database: mysql-myisam-symlink-security-bypass(45649)
Common Vulnerability Exposure (CVE) ID: CVE-2008-4456
BugTraq ID: 31486
Bugtraq: 20080930 MySQL command-line client HTML injection vulnerability (Google Search)
Bugtraq: 20080930 RE: MySQL command-line client HTML injection vulnerability (Google Search)
Bugtraq: 20081004 RE: RE: MySQL command-line client HTML injection vulnerability (Google Search)
Bugtraq: 20081029 Re: MySQL command-line client HTML injection vulnerability (Google Search)
Debian Security Information: DSA-1783 (Google Search)
XForce ISS Database: mysql-commandline-xss(45590)
Common Vulnerability Exposure (CVE) ID: CVE-2009-2446
BugTraq ID: 35609
Bugtraq: 20090708 MySQL <= 5.0.45 post auth format string vulnerability (Google Search)
XForce ISS Database: mysql-dispatchcommand-format-string(51614)
Common Vulnerability Exposure (CVE) ID: CVE-2009-4030
Debian Security Information: DSA-1997 (Google Search)
SuSE Security Announcement: SUSE-SR:2010:011 (Google Search)
SuSE Security Announcement: SUSE-SR:2010:021 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2008-2079
BugTraq ID: 29106
BugTraq ID: 31681
Debian Security Information: DSA-1608 (Google Search)
SuSE Security Announcement: SUSE-SR:2008:017 (Google Search)
XForce ISS Database: mysql-myisam-security-bypass(42267)
CopyrightCopyright (c) 2010 E-Soft Inc.

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

© 1998-2021 E-Soft Inc. All rights reserved.