|
Home   Programs Emergency management Response CCIRC Analytical releases2 AV06-014: Vulnerabilities in MySQL
Number: AV06-014
Date: 4 May 2006 PurposeThe purpose of this advisory is to bring attention to multiple vulnerabilities in MySQL that may allow unauthenticated information disclosure and the execution of arbitrary code by a remote, authenticated user.
AssessmentProof of concept code exploiting these vulnerabilities has been publicly released. An unauthenticated remote user sending a specially crafted login or COM_TABLE_DUMP packets may be able to read uninitialised memory, potentially leading to information disclosure. An authenticated remote user using a specially crafted COM_TABLE_DUMP packet may be able to execute arbitrary code on a MySQL server. This vulnerability exists in MySQL 5.x.x. Suggested actionPSEPC recommends that administrators test and upgrade to MySQL 5.0.21, 5.1.10 or 4.1.19. Versions 5.1.10 and 4.1.19 were unreleased at the time of writing. For more information, please refer to:
http://www.auscert.org.au/render.html?it=6261
http://dev.mysql.com/doc/connector/j/en/news-5-0-21.html
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-10.html
http://dev.mysql.com/doc/refman/4.1/en/news-4-1-19.html
Note to readersPublic Safety and Emergency Preparedness Canada (PSEPC) collects information related to cyber and physical threats to, and incidents involving, Canadian critical infrastructure. This allows us to monitor and analyze threats and to issue alerts, advisories and other information products. To report threats or incidents, please contact the Government Operations Centre (GOC) at (613) 991-7000 or goc-cog@psepc-sppcc.gc.ca by e-mail. Unauthorized use of computer systems and mischief in relation to data are serious Criminal Code offences in Canada. Any suspected criminal activity should be reported to local law enforcement organizations. The Royal Canadian Mounted Police (RCMP) National Operations Centre (N.O.C.) provides a 24/7 service to receive such reports or to redirect callers to local law enforcement organizations. The N.O.C. can be reached at (613) 993-4460. National security concerns should be reported to the Canadian Security Intelligence Service (CSIS) at (613) 993-9620. For urgent matters or to report any incidents, please contact the Government Operations Centre at: Phone: (613) 991-7000
Fax: (613) 996-0995
Secure Fax: (613) 991-7094
Email: goc-cog@psepc-sppcc.gc.ca For general information on critical infrastructure protection and emergency preparedness, please contact PSEPC's Public Affairs division at: Telephone: (613) 944-4875 or 1-800-830-3118
Fax: (613) 998-9589
E-mail: communications@psepc-sppcc.gc.ca
Web: www.psepc.gc.ca
|
Printable version
Send this page