MySQL-4.0.7 released
1 отговора
123 прегледа
MySQL-4.0.7 released
MySQL 4.0.7, a new version of the popular Open Source Database, has been
released. It is now available in source and binary form for a number of
platforms from our download pages at [линк] and
mirror sites.
Around the time MySQL 4.0.6 was ready to be released to fix the security
vulnerabilities that have been reported to us by eMatters GmbH, we were
informed about another potential security vulnerability. Because the 4.0.6
builds were almost completed at this point, and we wanted to get these out
to fix the already widely known security issues, we decided to resolve
this vulnerability for MySQL 4.0.7 instead and release it immediately
after MySQL 4.0.6.
Please note, that this does only affect the MySQL 4.0.x releases - MySQL
3.23 is not affected by this.
A short description of the vulnerability:
o MySQL 4.0 did not properly check the user's privileges when receiving
the deprecated client function call mysql_drop_db().
o This allowed any user to arbitrary drop any database, if he was able
to log in as a valid user and his MySQL client application used the
obsolete mysql_drop_db() function call instead of the "DROP DATABASE"
SQL statement.
o When using "DROP DATABASE", the user's privileges were always verified
correctly.
o This bug could not be exploited without a valid MySQL user account -
it was not possible for an anonymous remote attacker to perform this
operation.
o So far, we are only aware of one application that still uses
this function call, but the development of it has been discontinued.
o The "mysql" client application provided with the MySQL distribution
as well as the MySQL Control Center cannot be used to exploit this
vulnerability.
o No data was compromised from other users' databases - this bug did not
affect the privileges required to actually read data from other
databases or tables.
o If logging was enabled (e.g. by using the "--log" or "--log-bin"
command line switches), the operation was also logged by the MySQL
server, even including the user and host name if "--log" was used.
We would like to thank Gary Huntress for making us aware of this problem.
News from the MySQL 4.0.7 ChangeLog:
Functionality added or changed:
* `mysqlbug' now also reports the compiler version used for building
the binaries (if the compiler supports the option `--version').
Bugs fixed:
* Fixed compilation problems on OpenUnix and HPUX 10.20.
* Fixed some optimisation problems when compiling MySQL with
`-DBIG_TABLES' on a 32 bit system.
* `mysql_drop_db()' didn't check permissions properly so anyone could
drop another users database. `DROP DATABASE' is checked properly.
Additional notes:
* It is quite possible that not all mirror sites have picked up
the Linux RPM packages yet, because the were added some time after
the other binary packages.
* Due to a hardware failure, we are currently unable to provide
Solaris 2.7 binaries - we apologize for any inconveniences that
may cause you. Some users reported, that the Solaris 2.8 package
worked for them on Solaris 2.7, too - so you might want to give
that a try. We are working on setting up a new Solaris 2.7 build
system and hope to have it available for future releases again.
salle.online.bg/sig
released. It is now available in source and binary form for a number of
platforms from our download pages at [линк] and
mirror sites.
Around the time MySQL 4.0.6 was ready to be released to fix the security
vulnerabilities that have been reported to us by eMatters GmbH, we were
informed about another potential security vulnerability. Because the 4.0.6
builds were almost completed at this point, and we wanted to get these out
to fix the already widely known security issues, we decided to resolve
this vulnerability for MySQL 4.0.7 instead and release it immediately
after MySQL 4.0.6.
Please note, that this does only affect the MySQL 4.0.x releases - MySQL
3.23 is not affected by this.
A short description of the vulnerability:
o MySQL 4.0 did not properly check the user's privileges when receiving
the deprecated client function call mysql_drop_db().
o This allowed any user to arbitrary drop any database, if he was able
to log in as a valid user and his MySQL client application used the
obsolete mysql_drop_db() function call instead of the "DROP DATABASE"
SQL statement.
o When using "DROP DATABASE", the user's privileges were always verified
correctly.
o This bug could not be exploited without a valid MySQL user account -
it was not possible for an anonymous remote attacker to perform this
operation.
o So far, we are only aware of one application that still uses
this function call, but the development of it has been discontinued.
o The "mysql" client application provided with the MySQL distribution
as well as the MySQL Control Center cannot be used to exploit this
vulnerability.
o No data was compromised from other users' databases - this bug did not
affect the privileges required to actually read data from other
databases or tables.
o If logging was enabled (e.g. by using the "--log" or "--log-bin"
command line switches), the operation was also logged by the MySQL
server, even including the user and host name if "--log" was used.
We would like to thank Gary Huntress for making us aware of this problem.
News from the MySQL 4.0.7 ChangeLog:
Functionality added or changed:
* `mysqlbug' now also reports the compiler version used for building
the binaries (if the compiler supports the option `--version').
Bugs fixed:
* Fixed compilation problems on OpenUnix and HPUX 10.20.
* Fixed some optimisation problems when compiling MySQL with
`-DBIG_TABLES' on a 32 bit system.
* `mysql_drop_db()' didn't check permissions properly so anyone could
drop another users database. `DROP DATABASE' is checked properly.
Additional notes:
* It is quite possible that not all mirror sites have picked up
the Linux RPM packages yet, because the were added some time after
the other binary packages.
* Due to a hardware failure, we are currently unable to provide
Solaris 2.7 binaries - we apologize for any inconveniences that
may cause you. Some users reported, that the Solaris 2.8 package
worked for them on Solaris 2.7, too - so you might want to give
that a try. We are working on setting up a new Solaris 2.7 build
system and hope to have it available for future releases again.
salle.online.bg/sig
Re: MySQL-4.0.7 released
Да бе аз тъкмо свалих гамата........
Нещо по-значително има ли в тоя ъпдейт?
jacket.hit.bg
[email protected]
Нещо по-значително има ли в тоя ъпдейт?
jacket.hit.bg
[email protected]