[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-Disclosure] [TURBOLINUX SECURITY INFO] 07/Oct/2003

To: security-announce@turbolinux.co.jp
Subject: [Full-Disclosure] [TURBOLINUX SECURITY INFO] 07/Oct/2003
From: Turbolinux <security-announce@turbolinux.co.jp>
Date: Tue, 7 Oct 2003 19:15:36 +0900
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is an announcement only email list for the x86 architecture.
============================================================
Turbolinux Security Announcement 07/Oct/2003
============================================================

The following page contains the security information of Turbolinux Inc.

 - Turbolinux Security Center
   http://www.turbolinux.com/security/

 (1) MySQL -> Buffer overflow


===========================================================
* MySQL -> Buffer overflow
===========================================================

More information :
    MySQL is a true multi-user, multi-threaded SQL database server.
    A buffer overrun condition exists in get_salt_from_password from sql_acl.cc.

 Impact :
    This vulnerability may allow an attacker with ALTER TABLE privileges to 
execute arbitrary code
    via a long Password field.

 Affected Products :
    - Turbolinux 8 Server
    - Turbolinux 8 Workstation
    - Turbolinux 7 Server
    - Turbolinux 7 Workstation
    - Turbolinux Server 6.5
    - Turbolinux Advanced Server 6
    - Turbolinux Server 6.1
    - Turbolinux Workstation 6.0


 Solution :
    Please use turbopkg(zabom) tool to apply the update.
 ---------------------------------------------
 # turbopkg
 or
 # zabom update MySQL MySQL-bench MySQL-client MySQL-devel MySQL-shared
 ---------------------------------------------


 <Turbolinux 8 Server>

   Source Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 87548b1f3a418ce5d95af38ed527e98e

   Binary Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-3.23.58-1.i586.rpm
      5055971 0bfb25a6a8a14b2cd510db8444ef84c8
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
       612003 fa0d14181849da0e5982bda7a701a077
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
       156004 4eb6c7ba8a27f4980924b53df141270c
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
      1148777 478addc59f87d0c0be182a19fec06804
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
       192871 bc2c8ac350cb836f5a2f76dd5fea983b

 <Turbolinux 8 Workstation>

   Source Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 815ace4785452aad0ecd122c49805011

   Binary Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-3.23.58-1.i586.rpm
      5055683 54d4f8563763fa21d82edaf04fd584a5
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
       612023 a996aa237aee7aef7bee2d561950e25a
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
       155961 68fcfdde1269122d124cd52631744178
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
      1148969 4a36ecfd66131c666f75aad9942861f5
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
       192971 c061c321c5c1492d9c615fae03a4fbed

 <Turbolinux 7 Server>

   Source Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 67f11e13192ac1690c296d1e67c4d924

   Binary Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-3.23.58-1.i586.rpm
      4973477 f9cca3469a07d93dcecbf22ae68ac9fe
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
       613743 215472ced1ae456c938debe92dd77699
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
       151767 0e5aafa1ca5c354a149ce95f067715f4
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
      1086922 56a3b8937aa293f17a7b5da4cc3caba0
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
       186170 e3aa7f2dc7c4e40e8bbb35f90f878e9e

 <Turbolinux 7 Workstation>

   Source Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 ae4323e83c921a5d660ca3060466e8be

   Binary Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-3.23.58-1.i586.rpm
      4974234 f1f8c38b3d0b5d50f24eff1b35147e02
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-bench-3.23.58-1.i586.rpm
       613498 352f389511656f14fc235615a6dbb8c6
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-client-3.23.58-1.i586.rpm
       151770 016b8bda6fb6c1bd897822ee97d6964e
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-devel-3.23.58-1.i586.rpm
      1086071 15102c5b31fe5a5629de6141a25d21c9
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/MySQL-shared-3.23.58-1.i586.rpm
       186514 68ce0298c3eb12ba9c66853109a3a647

 <Turbolinux Server 6.5>

   Source Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 490107b6fb28ce58c16300504be18d2e

   Binary Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-3.23.58-1.i386.rpm
      6150619 bef47369cb23199f71a967bcf81cc1a1
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-bench-3.23.58-1.i386.rpm
       731247 bffe436a19b79482af2cb7f72e95c44c
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-client-3.23.58-1.i386.rpm
       158946 d31b7dc62f7293d507518187316c896f
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-devel-3.23.58-1.i386.rpm
      1329162 66eb677a05c5b3d49bfe2666181a5d72
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/MySQL-shared-3.23.58-1.i386.rpm
       256291 5a4607d6589a77bd0bfb6c1045cc9606

 <Turbolinux Advanced Server 6>

   Source Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 5fc5593e97a455a4d5beb4e4e68c4517

   Binary Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-3.23.58-1.i386.rpm
      6150560 0df722bb008bc482147289caf60afc2a
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-bench-3.23.58-1.i386.rpm
       731170 d819d6fe4392a78229c84594997de0aa
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-client-3.23.58-1.i386.rpm
       158935 0999bdcda4373cbb5cba3f7bcdf865cb
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-devel-3.23.58-1.i386.rpm
      1329155 f5722aff46e6a6c2cb446322f2db5901
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServer/6/ja/updates/RPMS/MySQL-shared-3.23.58-1.i386.rpm
       256291 130be88f5aedb4d4bc0b94e4a7b668ce

 <Turbolinux Server 6.1>

   Source Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/SRPMS/MySQL-3.23.58-1.src.rpm
     12040644 6d088306780a214b4e30bcc906c8483f

   Binary Packages
   Size : MD5

   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-3.23.58-1.i386.rpm
      6149243 c6d65524d3d19c0515438c6809ce084f
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-bench-3.23.58-1.i386.rpm
       731171 86121adf1b602d7194dd90b626cdb0fd
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-client-3.23.58-1.i386.rpm
       158947 5d54f7af88c4cc1ce95c683b737046fd
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-devel-3.23.58-1.i386.rpm
      1329081 50c4b409fc4aec82e9fa832e18f821ab
   
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/updates/RPMS/MySQL-shared-3.23.58-1.i386.rpm
       256290 18ad33ceddd332200bbc7a14e6c062f9


 References :

 CVE
   [CAN-2003-0780]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0780

 --------------------------------------------------------------------------
 Revision History
    07 Oct 2003 Initial release
 --------------------------------------------------------------------------


 * You may need to update the turbopkg tool before applying the update.
Please refer to the following URL for detailed information.

  http://www.turbolinux.com/download/zabom.html
  http://www.turbolinux.com/download/zabomupdate.html

Package Update Path
http://www.turbolinux.com/update

============================================================
 * To obtain the public key

Here is the public key

 http://www.turbolinux.com/security/

 * To unsubscribe from the list

If you ever want to remove yourself from this mailing list,
  you can send a message to <server-users-e-ctl@turbolinux.co.jp> with
the word `unsubscribe' in the body (don't include the quotes).

unsubscribe

 * To change your email address

If you ever want to chage email address in this mailing list,
  you can send a message to <server-users-e-ctl@turbolinux.co.jp> with
the following command in the message body:

  chaddr 'old address' 'new address'

If you have any questions or problems, please contact
<supp_info@turbolinux.co.jp>

Thank you!

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/gpJPK0LzjOqIJMwRAnOGAJ0ZhXnOLj0N1/rBOdcavBtyOeSvvwCcCdul
OOwQpxohzEPKqDkS/rrlcYY=
=BxgQ
-----END PGP SIGNATURE-----



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Prev by Date: [Full-Disclosure] strange from address
Next by Date: [Full-Disclosure] Spam with PGP
Previous by thread: [Full-Disclosure] Re: strange from address
Next by thread: [Full-Disclosure] Spam with PGP
Index(es):
- Date
- Thread