Bugzilla Bug 84819

2002-2005 K-OTiK Security 

2002-2005 K-OTiK Security © Research and Monitoring Team 24/24 & 7/7

----------------------------------------------------------------------

                        -- 11 Mar. 2005 #1 --

----------------------------------------------------------------------



-  Mysql 4.x "CREATE FUNCTION" Arbitrary Code Execution Exploit 





   ## Mysql CREATE FUNCTION libc arbitrary code execution

   ##

   ## Vulnerable: Mysql <= 4.0.23, 4.1.10 

   ## 

   ## KOTIK/ADV-2005-0252



 

   Exploit - http://www.k-otik.com/exploits/20050310.mysqllibc.php

   Advisory  - http://www.k-otik.com/english/advisories/2005/0252





-  Mysql 4.x "CREATE FUNCTION" Arbitrary Library Injection Exploit 



   ## Mysql CREATE FUNCTION func table arbitrary library injection

   ##

   ## Vulnerable: Mysql <= 4.0.23, 4.1.10 

   ## 

   ## KOTIK/ADV-2005-0252



 

   Exploit - http://www.k-otik.com/exploits/20050310.mysqlcreate.php



----------------------------------------------------------------------

          RSS / XML : http://www.k-otik.com/exploits.xml

----------------------------------------------------------------------

               Copyright © 2002-2005 K-OTiK Security

----------------------------------------------------------------------

Mysql please verify and advise.

4.0.24 is not noted as vulnerable.
As 4.0.24 is tagged in MySQL's BK tree (and will be released soon my sources say), does anybody know if it has been tested for being vulnerable even?

4.0.24 is noted as the solution. which answers the question I think :)

one extra reason to go 4.0.24
http://secunia.com/advisories/14547/

it's the same reporter with one extra exploitation vector

4.0.24 is out. Robin please provide an updated ebuild.

The authors page at
http://www.k-otik.com/english/advisories/2005/0252
has 3 vulnerabilties.

The other page at
http://secunia.com/advisories/14547/
has only 2 vulnerabilties

Which I find strange.

Upstream has released 4.1.10a, but they don't seem to have 4.0.24 out yet when I checked a moment ago. I'd expect it to be released in a matter of hours. It fixes a lot of problems with 4.0.2[23], and it's been a long time in coming.

I'm just heading to bed now.

*** Bug 84859 has been marked as a duplicate of this bug. ***

*** Bug 84924 has been marked as a duplicate of this bug. ***

4.0.24 has been released
http://dev.mysql.com/downloads/mysql/4.0.html

as 4.0.24 and 4.1.10a have been released, is there any schedule for
those versions to hit the portage tree?!

I'm busy testing 4.0.24 now, I should get it out to ~arch in a few hours.

Ok, 4.0.24-r0 and 4.0.24-r1 are in the tree now as ~arch.
4.0.24-r0 is based strictly off 4.0.23 (with the addition of a src_test function).
4.0.24-r1 implements a number of modifications that upstream has requested and have been under development until now (the discussion is in bug #44592), as well as implementing a USE=minimal mode for MySQL.

I only expect arches to stabilize 4.0.24-r0 at this point (and let -r1 go thru the normal month of testing).

To test the ebuilds:
USE="berkdb ssl perl readline ssl tcpd" FEATURES="test" emerge =dev-db/mysql-4.0.24

MySQL-4.1 has not ever been out of p.mask yet, and still doesn't work on my testing machine. I've got a user helping me out with it, and I'll try and see that we get 4.1.10a into the tree within the next 2 weeks (I don't have time to do it sooner, as I've got exams next week).

Thx Robin.

Arches please test and mark stable.

Stable on ppc.

compiled fine, tests finished successfull but i got an access violation on
amd64:

------------------------------------------

Ending Tests
Shutting-down MySQL daemon

Master shutdown finished
Slave shutdown finished
All 209 tests were successful.

--------------------------- ACCESS VIOLATION SUMMARY
---------------------------
LOG FILE = "/tmp/sandbox-dev-db_-_mysql-4.0.24-9374.log"

open_wr:   /this-dir-does-not-exist/t9.MYI
--------------------------------------------------------------------------------

same access violation on ppc64. if I leave out FEATURES="test" the ebuild
installs smooth and mysqld runs.

Not marked stable on ppc64 yet.

Please do at least minimal testing BEFORE marking stable. See Bug 85095 - the
init script is just totally broken. 

Jakub Moc: we are about to mark mysql-4.0.24 stable not mysql-4.0.24-r1. That
init script works, does it? (for me it does!)

So does it for me. I did some small tests and they were successful.

Stable on SPARC.

Re the tests and sandbox violation of '/this-dir-does-not-exist/t9.MYI'
I've looked at the test sources, and added an addpredict entry into the ebuilds for it.

Markus: Oh, sorry. :/ I just tried to emerge latest unstable 4.0.x and did not
notice that it was not the right version to become stable now. 

works now, stable on amd64

stable on ppc64

Jakub: ^_^

Stable on mips.

Stable on hppa.

Stable on alpha.

x86 done, after a lot more testing to be sure :-).

GLSA 200503-19

arm, ia64, s390 please remember to mark stable to benifit from the GLSA.

when will 4.1 be in portage so that we can use the new gui's...the good old
mysqlcc is marked as depreciated by upstream...gentoo really needs to catch up!

Wow... that had absolutely nothing to do with this bug...

I think James gets today's award for off-topic post to a bug report...