ID de Prueba:	1.3.6.1.4.1.25623.1.0.68246
Categoría:	Mandrake Local Security Checks
Título:	Mandriva Security Advisory MDVSA-2010:155 (mysql)
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing an update to mysql announced via advisory MDVSA-2010:155. Multiple vulnerabilities has been found and corrected in mysql: MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory (CVE-2010-2008). Additionally many security issues noted in the 5.1.49 release notes has been addressed with this advisory as well, such as: * LOAD DATA INFILE did not check for SQL errors and sent an OK packet even when errors were already reported. Also, an assert related to client-server protocol checking in debug servers sometimes was raised when it should not have been. (Bug#52512) * Using EXPLAIN with queries of the form SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...) could cause a server crash. (Bug#52711) * The server could crash if there were alternate reads from two indexes on a table using the HANDLER interface. (Bug#54007) * A malformed argument to the BINLOG statement could result in Valgrind warnings or a server crash. (Bug#54393) * Incorrect handling of NULL arguments could lead to a crash for IN() or CASE operations when NULL arguments were either passed explicitly as arguments (for IN()) or implicitly generated by the WITH ROLLUP modifier (for IN() and CASE). (Bug#54477) * Joins involving a table with with a unique SET column could cause a server crash. (Bug#54575) * Use of TEMPORARY InnoDB tables with nullable columns could cause a server crash. (Bug#54044) The updated packages have been patched to correct these issues. Affected: 2010.0, 2010.1 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2010:155 http://bugs.mysql.com/bug.php?id=52512 http://bugs.mysql.com/bug.php?id=52711 http://bugs.mysql.com/bug.php?id=54007 http://bugs.mysql.com/bug.php?id=54393 http://bugs.mysql.com/bug.php?id=54477 http://bugs.mysql.com/bug.php?id=54575 http://bugs.mysql.com/bug.php?id=54044 Risk factor : Medium CVSS Score: 3.5
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2010-2008 BugTraq ID: 41198 http://www.securityfocus.com/bid/41198 http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044546.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:155 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11869 http://www.securitytracker.com/id?1024160 http://secunia.com/advisories/40333 http://secunia.com/advisories/40762 http://www.ubuntu.com/usn/USN-1017-1 http://www.ubuntu.com/usn/USN-1397-1 http://www.vupen.com/english/advisories/2010/1918
Copyright	Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.