-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 --------------------------------------------------------------------------
   Turbolinux Security Advisory TLSA-2003-56
   http://www.turbolinux.com/security/
                                             security-team@turbolinux.co.jp
 --------------------------------------------------------------------------

 Original released date : 07 Oct 2003
 Last revised           : 07 Oct 2003

 Package : MySQL

 Summary : Buffer overflow

 More information :
    MySQL is a true multi-user, multi-threaded SQL database server.
    A buffer overrun condition exists in get_salt_from_password from sql_acl.cc.

 Impact :
    This vulnerability may allow an attacker with ALTER TABLE privileges to execute arbitrary code
    via a long Password field.

 Affected Products :
    - Turbolinux 8 Server
    - Turbolinux 8 Workstation
    - Turbolinux 7 Server
    - Turbolinux 7 Workstation
    - Turbolinux Server 6.5
    - Turbolinux Advanced Server 6
    - Turbolinux Server 6.1
    - Turbolinux Workstation 6.0


 Solution :
    Please use turbopkg(zabom) tool to apply the update.
 ---------------------------------------------
 # turbopkg
 or
 # zabom update MySQL MySQL-bench MySQL-client MySQL-devel MySQL-shared
 ---------------------------------------------


 <Turbolinux 8 Server>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 87548b1f3a418ce5d95af38ed527e98e

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-3.23.58-1.i586.rpm
      5055971 0bfb25a6a8a14b2cd510db8444ef84c8
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
       612003 fa0d14181849da0e5982bda7a701a077
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
       156004 4eb6c7ba8a27f4980924b53df141270c
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
      1148777 478addc59f87d0c0be182a19fec06804
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
       192871 bc2c8ac350cb836f5a2f76dd5fea983b

 <Turbolinux 8 Workstation>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 815ace4785452aad0ecd122c49805011

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-3.23.58-1.i586.rpm
      5055683 54d4f8563763fa21d82edaf04fd584a5
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
       612023 a996aa237aee7aef7bee2d561950e25a
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
       155961 68fcfdde1269122d124cd52631744178
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
      1148969 4a36ecfd66131c666f75aad9942861f5
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
       192971 c061c321c5c1492d9c615fae03a4fbed

 <Turbolinux 7 Server>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 67f11e13192ac1690c296d1e67c4d924

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-3.23.58-1.i586.rpm
      4973477 f9cca3469a07d93dcecbf22ae68ac9fe
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
       613743 215472ced1ae456c938debe92dd77699
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
       151767 0e5aafa1ca5c354a149ce95f067715f4
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
      1086922 56a3b8937aa293f17a7b5da4cc3caba0
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
       186170 e3aa7f2dc7c4e40e8bbb35f90f878e9e

 <Turbolinux 7 Workstation>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 ae4323e83c921a5d660ca3060466e8be

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-3.23.58-1.i586.rpm
      4974234 f1f8c38b3d0b5d50f24eff1b35147e02
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
       613498 352f389511656f14fc235615a6dbb8c6
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
       151770 016b8bda6fb6c1bd897822ee97d6964e
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
      1086071 15102c5b31fe5a5629de6141a25d21c9
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
       186514 68ce0298c3eb12ba9c66853109a3a647

 <Turbolinux Server 6.5>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 490107b6fb28ce58c16300504be18d2e

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-3.23.58-1.i386.rpm
      6150619 bef47369cb23199f71a967bcf81cc1a1
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-bench-3.23.58-1.i386.rpm
       731247 bffe436a19b79482af2cb7f72e95c44c
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-client-3.23.58-1.i386.rpm
       158946 d31b7dc62f7293d507518187316c896f
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-devel-3.23.58-1.i386.rpm
      1329162 66eb677a05c5b3d49bfe2666181a5d72
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-shared-3.23.58-1.i386.rpm
       256291 5a4607d6589a77bd0bfb6c1045cc9606

 <Turbolinux Advanced Server 6>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 5fc5593e97a455a4d5beb4e4e68c4517

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-3.23.58-1.i386.rpm
      6150560 0df722bb008bc482147289caf60afc2a
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-bench-3.23.58-1.i386.rpm
       731170 d819d6fe4392a78229c84594997de0aa
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-client-3.23.58-1.i386.rpm
       158935 0999bdcda4373cbb5cba3f7bcdf865cb
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-devel-3.23.58-1.i386.rpm
      1329155 f5722aff46e6a6c2cb446322f2db5901
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-shared-3.23.58-1.i386.rpm
       256291 130be88f5aedb4d4bc0b94e4a7b668ce

 <Turbolinux Server 6.1>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 6d088306780a214b4e30bcc906c8483f

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-3.23.58-1.i386.rpm
      6149243 c6d65524d3d19c0515438c6809ce084f
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-bench-3.23.58-1.i386.rpm
       731171 86121adf1b602d7194dd90b626cdb0fd
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-client-3.23.58-1.i386.rpm
       158947 5d54f7af88c4cc1ce95c683b737046fd
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-devel-3.23.58-1.i386.rpm
      1329081 50c4b409fc4aec82e9fa832e18f821ab
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-shared-3.23.58-1.i386.rpm
       256290 18ad33ceddd332200bbc7a14e6c062f9


 References :

 CVE
   [CAN-2003-0780]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0780

 --------------------------------------------------------------------------
 Revision History
    07 Oct 2003 Initial release
 --------------------------------------------------------------------------

 Copyright(C) 2003 Turbolinux, Inc. All rights reserved. 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/gpMLK0LzjOqIJMwRAo50AJ9Y4XPN2d8fJF5hi6ciSKhdhyRqEQCfW7GB
ujkEj9izcX+MvYu7CNVpy+I=
=U1Eq
-----END PGP SIGNATURE-----