| Description: | Description:
The remote host is missing updates announced in
advisory FLSA-2005:2129.
This update fixes a number of potential security problems associated
with careless handling of temporary files. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the names
CVE-2004-0381, CVE-2004-0388, CVE-2004-0457, and CVE-2005-0004 to these
issues.
Oleksandr Byelkin discovered that ALTER TABLE ... RENAME checked
the CREATE/INSERT rights of the old table instead of the new one. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0835 to this issue.
Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect
function. In order to exploit this issue an attacker would need to force
the use of a malicious DNS server (CVE-2004-0836).
Dean Ellis discovered that multiple threads ALTERing the same (or
different) MERGE tables to change the UNION could cause the server to
crash or stall (CVE-2004-0837).
Sergei Golubchik discovered that if a user is granted privileges to a
database with a name containing an underscore (_), the user also gains
the ability to grant privileges to other databases with similar names
(CVE-2004-0957).
All users of mysql should upgrade to these updated packages, which
resolve these issues.
Affected platforms:
Redhat 7.3
Redhat 9
Fedora Core 1
Solution:
https://secure1.securityspace.com/smysecure/catid.html?in=FLSA-2005:2129
Risk factor : Critical
CVSS Score:
10.0
|
