[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[debian-users:44820] [Translate] [SECURITY] [DSA 833-1] New mysql-dfsg-4.1 packages fix arbitrary code execution

From: Seiji Kaneko <skaneko@xxxxxxxxxxxx>
Subject: [debian-users:44820] [Translate] [SECURITY] [DSA 833-1] New mysql-dfsg-4.1 packages fix arbitrary code execution
Date: Sat, 1 Oct 2005 17:49:41 +0900
List-help: <mailto:debian-users-ctl@debian.or.jp?body=help>
List-id: debian-users.debian.or.jp
List-owner: <mailto:debian-users-admin@debian.or.jp>
List-post: <mailto:debian-users@debian.or.jp>
List-software: fml [fml 4.0.3 release (20011202/4.0.3)]
List-unsubscribe: <mailto:debian-users-ctl@debian.or.jp?body=unsubscribe>
X-accept-language: ja, en-us, en
X-ml-info: If you have a question, send e-mail with the body "help" (without quotes) to the address debian-users-ctl@debian.or.jp; help=<mailto:debian-users-ctl@debian.or.jp?body=help>
X-ml-name: debian-users
X-mlserver: fml [fml 4.0.3 release (20011202/4.0.3)]; post only (only members can post)
X-original-to: debian-users@debian.or.jp
Message-id: <433E4DA1.9080300@xxxxxxxxxxxx>
X-mail-count: 44820
User-agent: Mozilla Thunderbird 1.0.7 (Macintosh/20050923)

かねこです。
URL 等は Debian-security-announce メーリングリストの元記事を確認
ください。

------>8------------>8------------>8------------>8------------>8-
- --------------------------------------------------------------------------
Debian Security Advisory DSA 833-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
October 1st, 2005                       http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : mysql-dfsg-4.1
Vulnerability  : バッファオーバフロー
Problem type   : リモート
Debian-specific: いいえ
CVE ID         : CAN-2005-2558
BugTraq ID     : 14509

人気のあるデータベース MySQL の init_syms 関数にスタックベースのバッファ
オーバフローが発見されました。この欠陥は長い function_name 名を用いること
で攻撃可能で、ユーザ関数を作成する権限を持つユーザがリモートから任意のコ
ードの実行が可能です。ただし、ユーザ関数を作成する権限は、通常信用できな
いユーザに与えられることはありません。

以下が、この問題を修正した MySQL のバージョンを示す表です。

                     woody              sarge              sid
mysql             3.23.49-8.14           n/a               n/a
mysql-dfsg            n/a          4.0.24-10sarge1    4.0.24-10sarge1
mysql-dfsg-4.1        n/a          4.1.11a-4sarge2        4.1.14-2
mysql-dfsg-5.0        n/a                n/a            5.0.11beta-3

直ぐに mysql-dfsg-4.1 パッケージをアップグレードすることを勧めます。

アップグレード手順
------------------

wget url
	でファイルを取得できます。
dpkg -i file.deb
        で参照されたファイルをインストールできます。

を用いて、apt-get パッケージマネージャに以下記載の sources.list を与えて
次のコマンドを使ってください。

apt-get update
        これは内部データベースを更新します。
apt-get upgrade
        これで修正されたパッケージをインストールします。

本メールのフッタ記載の設定を自ホストの設定に加えることにより、自動更新を
行うこともできます。

Debian GNU/Linux 3.1 愛称 sarge
- --------------------------------

  ソースアーカイブ:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-dfsg-4.1_4.1.11a-4sarge2.dsc
      Size/MD5 checksum:     1021 ef5b7f754fd69c6ddf96185a9ea99d8c

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-dfsg-4.1_4.1.11a-4sarge2.diff.gz
      Size/MD5 checksum:   163217 c22faa82cad1a38568146d03a316b4c3

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-dfsg-4.1_4.1.11a.orig.tar.gz
      Size/MD5 checksum: 15771855 3c0582606a8903e758c2014c2481c7c3

  Architecture independent components:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-common-4.1_4.1.11a-4sarge2_all.deb
      Size/MD5 checksum:    35758 f4c17c57aaed4aba0d06b22391a443ff

  Alpha architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_alpha.deb
      Size/MD5 checksum:  1589626 326e06854e8cc7b4df3ca853a8776e6f

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_alpha.deb
      Size/MD5 checksum:  7963496 4da7672c7e6ce497cc6c2b72c2438c5f

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_alpha.deb
      Size/MD5 checksum:  1000022 a8edacbc3c87b781c4aae6772c42f2c9

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_alpha.deb
      Size/MD5 checksum: 17484824 d0e8f9bfebd9c492d0ed336c236050ad

  AMD64 architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_amd64.deb
      Size/MD5 checksum:  1450438 8e3eca09ae3044bc15d7332a97eaadb3

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_amd64.deb
      Size/MD5 checksum:  5549144 3b9308fd3c89158b20ae75ab4835d333

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_amd64.deb
      Size/MD5 checksum:   848676 0cdc8e7e48e1821fcbab39aee1c6b22b

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_amd64.deb
      Size/MD5 checksum: 14709814 b602e0bff5fda27efbc2bf52c0b46e32

  ARM architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_arm.deb
      Size/MD5 checksum:  1388184 ba83a61338a7b6198754c22e134bdabd

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_arm.deb
      Size/MD5 checksum:  5557760 54ac64644fe2897b5c2554f5332bf402

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_arm.deb
      Size/MD5 checksum:   835900 a29f9b8bfe41d70e24cb6eef94b43bc9

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_arm.deb
      Size/MD5 checksum: 14555832 a482f115a2f27abee4ad2a79dfbd6cd1

  Intel IA-32 architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_i386.deb
      Size/MD5 checksum:  1416570 e49242dae5f45b947a47ea1fe728d128

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_i386.deb
      Size/MD5 checksum:  5641688 b3eb7e254df56c09ada9c1fa61fab946

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_i386.deb
      Size/MD5 checksum:   829688 f3cdde3f2a6698f394ba0edfdbd29446

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_i386.deb
      Size/MD5 checksum: 14556498 45421b845326a2e40a720dc44b64985d

  Intel IA-64 architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_ia64.deb
      Size/MD5 checksum:  1711912 475cfa72891c402d1c948be09e6a98f7

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_ia64.deb
      Size/MD5 checksum:  7780996 03bd4ba1db9460ef9d9be5b01d880453

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_ia64.deb
      Size/MD5 checksum:  1049796 b8253e96506666bc4a3b659994bdd48a

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_ia64.deb
      Size/MD5 checksum: 18474740 4a483fc2350bda7a6eb2599c7fbf9e0d

  HP Precision architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_hppa.deb
      Size/MD5 checksum:  1550304 aadb8f7fbda0ef84b8afcf7baf76dffb

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_hppa.deb
      Size/MD5 checksum:  6249354 21f0e228f658552c1ecb4d05975e3921

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_hppa.deb
      Size/MD5 checksum:   909194 235968a78d019efc6be2e1df68fb4cb3

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_hppa.deb
      Size/MD5 checksum: 15786932 aee2e68c3f7938d0ba7292289f032bda

  Motorola 680x0 architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_m68k.deb
      Size/MD5 checksum:  1396882 3ef005165d935a0089c42b9dca782125

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_m68k.deb
      Size/MD5 checksum:  5282906 9becdb0b18c3c42b5211739e9f5f5f46

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_m68k.deb
      Size/MD5 checksum:   803022 43eb1fdfe29144e10d1730f1dcc45507

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_m68k.deb
      Size/MD5 checksum: 14070110 51c9d88be73414000742c7c2961307a1

  Big endian MIPS architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge1_mips.deb
      Size/MD5 checksum:  1477766 fb7a8d1fb9d4607d7172c36032ebcbbb

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge1_mips.deb
      Size/MD5 checksum:  6051760 6e97430bc9b02e866e04414e627f9f4c

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge1_mips.deb
      Size/MD5 checksum:   903542 f99636d7c17d9b9647c34d3dd3379c2d

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge1_mips.deb
      Size/MD5 checksum: 15407442 36eaf9d65e7c4dcaeff920389c6bd890

  Little endian MIPS architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_mipsel.deb
      Size/MD5 checksum:  1445350 539eadf9ac7e9b384825c944759ec6b4

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_mipsel.deb
      Size/MD5 checksum:  5969562 bdf9697878b6a439d079528660a67fbc

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_mipsel.deb
      Size/MD5 checksum:   889260 07d1f0071ce62ce433c9c924544fe5fc

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_mipsel.deb
      Size/MD5 checksum: 15103284 5be83f139ae6ac41ffad5a2a7a52ce49

  PowerPC architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_powerpc.deb
      Size/MD5 checksum:  1475432 2fc2f711fd16172952db58a59c17f9cb

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_powerpc.deb
      Size/MD5 checksum:  6025146 f230533abfce5f92e7ee95d0966ea984

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_powerpc.deb
      Size/MD5 checksum:   906432 d566b964257453976d7c36e309b705de

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_powerpc.deb
      Size/MD5 checksum: 15402508 dc78398b45128bc2d2f6881427ff044d

  IBM S/390 architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_s390.deb
      Size/MD5 checksum:  1537572 fc84f1f6e3f72bf3e62ae6d09fd29ed5

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_s390.deb
      Size/MD5 checksum:  5460800 94db267d9e373a8490a0067257ae14a4

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_s390.deb
      Size/MD5 checksum:   883408 9f613cb6264d5fd7da0c216301e34af1

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_s390.deb
      Size/MD5 checksum: 15053922 3d90c52ba65c7550da1558bb7d5ab346

  Sun Sparc architecture:


http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.11a-4sarge2_sparc.deb
      Size/MD5 checksum:  1459496 478640727168f01c3832f53ada90b8d9

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.11a-4sarge2_sparc.deb
      Size/MD5 checksum:  6205444 427316f73787f388a361c76124e59cb5

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.11a-4sarge2_sparc.deb
      Size/MD5 checksum:   867394 9e2217f00d72fa652b5e45fae5829eb8

http://security.debian.org/pool/updates/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.11a-4sarge2_sparc.deb
      Size/MD5 checksum: 15390434 e79df4002a1dfb61f2253030e8cb1033


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

------>8------------>8------------>8------------>8------------>8-
-- 
Seiji Kaneko                         skaneko@xxxxxxxxxxxx
---------------------------------------------------------

Prev by Date: [debian-users:44819] [Translate] [SECURITY] [DSA 835-1] New cfengine packages fix arbitrary file overwriting
Next by Date: [debian-users:44821] Re: カーネル再構築(2.6.11)でコンパイルエラーになります
Previous by thread: [debian-users:44819] [Translate] [SECURITY] [DSA 835-1] New cfengine packages fix arbitrary file overwriting
Next by thread: [debian-users:44821] Re: カーネル再構築(2.6.11)でコンパイルエラーになります
Index(es):
- Date
- Thread