Graphical Version |
Home Programs Emergency management Response CCIRC Analytical releases2 AV06-014: Vulnerabilities in MySQL Vulnerabilities in MySQLNumber: AV06-014 PurposeThe purpose of this advisory is to bring attention to multiple vulnerabilities in MySQL that may allow unauthenticated information disclosure and the execution of arbitrary code by a remote, authenticated user. AssessmentProof of concept code exploiting these vulnerabilities has been publicly released. An unauthenticated remote user sending a specially crafted login or COM_TABLE_DUMP packets may be able to read uninitialised memory, potentially leading to information disclosure. An authenticated remote user using a specially crafted COM_TABLE_DUMP packet may be able to execute arbitrary code on a MySQL server. This vulnerability exists in MySQL 5.x.x. Suggested actionPSEPC recommends that administrators test and upgrade to MySQL 5.0.21, 5.1.10 or 4.1.19. Versions 5.1.10 and 4.1.19 were unreleased at the time of writing. For more information, please refer to: Note to readersPublic Safety and Emergency Preparedness Canada (PSEPC) collects information related to cyber and physical threats to, and incidents involving, Canadian critical infrastructure. This allows us to monitor and analyze threats and to issue alerts, advisories and other information products. To report threats or incidents, please contact the Government Operations Centre (GOC) at (613) 991-7000 or goc-cog@psepc-sppcc.gc.ca by e-mail.Unauthorized use of computer systems and mischief in relation to data are serious Criminal Code offences in Canada. Any suspected criminal activity should be reported to local law enforcement organizations. The Royal Canadian Mounted Police (RCMP) National Operations Centre (N.O.C.) provides a 24/7 service to receive such reports or to redirect callers to local law enforcement organizations. The N.O.C. can be reached at (613) 993-4460. National security concerns should be reported to the Canadian Security Intelligence Service (CSIS) at (613) 993-9620. For urgent matters or to report any incidents, please contact the Government Operations Centre at: Phone: (613) 991-7000 For general information on critical infrastructure protection and emergency preparedness, please contact PSEPC's Public Affairs division at: Telephone: (613) 944-4875 or 1-800-830-3118 |