OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[Full-disclosure] rPSA-2006-0089-1 mysql mysql-bench mysql-server

From: Justin M. Forbes (jmforbesrpath.com)
Date: Thu Jun 01 2006 - 14:05:33 CDT

rPath Security Advisory: 2006-0089-1
Published: 2006-06-01
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
    Local System User Deterministic Vulnerability
Updated Versions:
    mysql=/conary.rpath.comrpl:devel//1/5.0.22-1-0.1
    mysql-bench=/conary.rpath.comrpl:devel//1/5.0.22-1-0.1
    mysql-server=/conary.rpath.comrpl:devel//1/5.0.22-1-0.1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2753
    http://issues.rpath.com/browse/RPL-396
    http://lists.mysql.com/announce/364

Description:
    Previous versions of mysql server and client libraries contain
    weaknesses parsing certain character encodings (such as SJIS,
    BIG5 and GBK, but not ASCII) which, when using the vulnerable
    encodings, can enable SQL injection attacks against applications
    (particularly web applications) which use non-standard escaping of
    quote characters.
    
    Because vulnerable escaping of quote characters is no longer allowed,
    some existing applications may not function correctly when used with
    the new release of mysql.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/