----------------------------------------------------------------------

Monitor, Filter, and Manage Security Information
- Filtering and Management of Secunia advisories
- Overview, documentation, and detailed reports
- Alerting via email and SMS

Request Trial:
https://ca.secunia.com/?f=l

----------------------------------------------------------------------

TITLE:
MySQL Two Vulnerabilities

SECUNIA ADVISORY ID:
SA14547

VERIFY ADVISORY:
http://secunia.com/advisories/14547/

CRITICAL:
Less critical

IMPACT:
Privilege escalation, System access

WHERE:
>From local network

SOFTWARE:
MySQL 4.x
http://secunia.com/product/404/

DESCRIPTION:
Stefano Di Paola has reported two vulnerabilities in MySQL, which
potentially can be exploited by malicious users to compromise a
vulnerable system and by malicious, local users to perform certain
actions on a vulnerable system with escalated privileges.

1) An input validation error in the "udf_init()" function in
"sql_udf.cc" causes the "dl" field of the "mysql.func" table to not
be properly sanitised before being used to load libraries. This can
be exploited by manipulating the "mysql" administrative database
directly via a "INSERT INTO" statement instead of using "CREATE
FUNCTION".

Successful exploitation allows loading a malicious library from an
arbitrary location, but requires "INSERT" and "DELETE" permissions on
the "mysql" administrative database.

NOTE: This can be exploited remotely if a user has privileges to
create local files via a "SELECT ... INTO OUTFILE" statement.

2) Temporary files are created insecurely with the "CREATE TEMPORARY
TABLE" command and can be exploited via symlink attacks to overwrite
arbitrary files with the privileges of MySQL.

The vulnerabilities have been reported in versions 4.0.23, and 4.1.10
and prior.

SOLUTION:
The vulnerabilities have been fixed in version 4.0.24.

Do not grant untrusted users privileges to perform "CREATE TEMPORARY
TABLE" statements and manipulate the "mysql" administrative database.

PROVIDED AND/OR DISCOVERED BY:
Stefano Di Paola

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------