[ GLSA 200405-20 ] Insecure Temporary File Creation In MySQL

[Thierry Carrez <koon () gentoo org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200405-20
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Insecure Temporary File Creation In MySQL
      Date: May 25, 2004
      Bugs: #46242
        ID: 200405-20

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Two MySQL utilities create temporary files with hardcoded paths,
allowing an attacker to use a symlink to trick MySQL into overwriting
important data.

Background
==========

MySQL is a popular open-source multi-threaded, multi-user SQL database
server.

Affected packages
=================

    -------------------------------------------------------------------
     Package       /   Vulnerable   /                       Unaffected
    -------------------------------------------------------------------
  1  dev-db/mysql      < 4.0.18-r2                        >= 4.0.18-r2

Description
===========

The MySQL bug reporting utility (mysqlbug) creates a temporary file to
log bug reports to. A malicious local user with write access to the
/tmp directory could create a symbolic link of the name mysqlbug-N
pointing to a protected file, such as /etc/passwd, such that when
mysqlbug creates the Nth log file, it would end up overwriting the
target file. A similar vulnerability exists with the mysql_multi
utility, which creates a temporary file called mysql_multi.log.

Impact
======

Since mysql_multi runs as root, a local attacker could use this to
destroy any other users' data or corrupt and destroy system files.

Workaround
==========

One could modify both scripts to log to a directory that users do not
have write permission to, such as /var/log/mysql/.

Resolution
==========

All users should upgrade to the latest stable version of MySQL.

    # emerge sync

    # emerge -pv ">=dev-db/mysql-4.0.18-r2"
    # emerge ">=dev-db/mysql-4.0.18-r2"

References
==========

  [ 1 ] CAN-2004-0381
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0381
  [ 2 ] CAN-2004-0388
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0388

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

     http://security.gentoo.org/glsa/glsa-200405-20.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Technologies, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAs7DVvcL1obalX08RArIlAJ44WS5mZ6JVO+WFz2zNh+gVyRJYsQCdEDdq
O9uEFUw2mEPAt3dFqKsRnbk=
=cYDI
-----END PGP SIGNATURE-----