Onderwerp: [FLSA-2005:2129] Updated mysql packages fix security issues

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig5CF5696B02F1F88C1C4CDB98
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

---------------------------------------------------------------------
Fedora Legacy Update Advisory

Synopsis: Updated mysql packages fix security issues
Advisory ID: FLSA:2129
Issue date: 2005-03-24
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2129
CVE Names: CAN-2004-0381 CAN-2004-0388 CAN-2004-0457
CAN-2004-0835 CAN-2004-0836 CAN-2004-0837
CAN-2004-0957 CAN-2005-0004
---------------------------------------------------------------------


---------------------------------------------------------------------
1. Topic:

Updated mysql packages that fix various security issues are now
available.

MySQL is a multi-user, multi-threaded SQL database server.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386

3. Problem description:

This update fixes a number of potential security problems associated
with careless handling of temporary files. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the names
CAN-2004-0381, CAN-2004-0388, CAN-2004-0457, and CAN-2005-0004 to these
issues.

Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked
the CREATE/INSERT rights of the old table instead of the new one. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect
function. In order to exploit this issue an attacker would need to force
the use of a malicious DNS server (CAN-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or
different) MERGE tables to change the UNION could cause the server to
crash or stall (CAN-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a
database with a name containing an underscore ("_"), the user also gains
the ability to grant privileges to other databases with similar names
(CAN-2004-0957).

All users of mysql should upgrade to these updated packages, which
resolve these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which
are not installed but included in the list will not be updated. Note
that you can also use wildcards (*.rpm) if your current directory *only*
contains the desired RPMs.

Please note that this update is also available via yum and apt. Many
people find this an easier way to apply updates. To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - bug #2129 - MySQL Remote Buffer Overflow

6. RPMs required:

Red Hat Linux 7.3:

SRPM:
http://download.fedoralegacy.org/red...legacy.src.rpm

i386:
http://download.fedoralegacy.org/red...egacy.i386.rpm
http://download.fedoralegacy.org/red...egacy.i386.rpm
http://download.fedoralegacy.org/red...egacy.i386.rpm

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/red...legacy.src.rpm

i386:
http://download.fedoralegacy.org/red...egacy.i386.rpm
http://download.fedoralegacy.org/red...egacy.i386.rpm
http://download.fedoralegacy.org/red...egacy.i386.rpm

Fedora Core 1:

SRPM:
http://download.fedoralegacy.org/fed...legacy.src.rpm

i386:
http://download.fedoralegacy.org/fed...egacy.i386.rpm
http://download.fedoralegacy.org/fed...egacy.i386.rpm
http://download.fedoralegacy.org/fed...egacy.i386.rpm
http://download.fedoralegacy.org/fed...egacy.i386.rpm

7. Verification:

SHA1 sum Package Name
---------------------------------------------------------------------

04ef0f04b389f7f9fc5bb46f35f81e8503a463ba
redhat/7.3/updates/i386/mysql-3.23.58-1.73.5.legacy.i386.rpm
879f133178898835609ec305988b473e7221f825
redhat/7.3/updates/i386/mysql-devel-3.23.58-1.73.5.legacy.i386.rpm
9258ee1dd63f878c376a4e8a4f28e6dc8be11600
redhat/7.3/updates/i386/mysql-server-3.23.58-1.73.5.legacy.i386.rpm
f8dfbc8e8992bb56c1f8ba9f6917ab0fb11d0e80
redhat/7.3/updates/SRPMS/mysql-3.23.58-1.73.5.legacy.src.rpm
246af76de738268375fee9c066efdabdc5a01f73
redhat/9/updates/i386/mysql-3.23.58-1.90.5.legacy.i386.rpm
22b584c92e81cd29086fa2335910ba5b67d22711
redhat/9/updates/i386/mysql-devel-3.23.58-1.90.5.legacy.i386.rpm
4fe21cae92371b5a3ed79858ec5432807bf2cee4
redhat/9/updates/i386/mysql-server-3.23.58-1.90.5.legacy.i386.rpm
106480fe6f5d56513a4fd77592d5a8e88a9c4825
redhat/9/updates/SRPMS/mysql-3.23.58-1.90.5.legacy.src.rpm
509f1caeef89bb626334be27e13c4269cc00ca75
fedora/1/updates/i386/mysql-3.23.58-4.3.legacy.i386.rpm
7e0bf52038d1ccb3e56f8f2e48f32846e9cb52ec
fedora/1/updates/i386/mysql-bench-3.23.58-4.3.legacy.i386.rpm
08c25d36193f30dceb4d3f81fbdd69f713fd94b7
fedora/1/updates/i386/mysql-devel-3.23.58-4.3.legacy.i386.rpm
8fa58175f2d1baf7d45e8c19939928d3faa113ba
fedora/1/updates/i386/mysql-server-3.23.58-4.3.legacy.i386.rpm
291ec6bb776126c3726dc7dfc067afad520300af
fedora/1/updates/SRPMS/mysql-3.23.58-4.3.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security. Our key is
available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0381
http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0388
http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0457
http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0835
http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0836
http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0837
http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0957
http://cve.mitre.org/cgi-bin/cvename...=CAN-2005-0004

9. Contact:

The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
project details at http://www.fedoralegacy.org

---------------------------------------------------------------------

--------------enig5CF5696B02F1F88C1C4CDB98
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCQ0hBLMAs/0C4zNoRAtypAKCjAA703slr8CH5nSnPOaYJmrxZxgCffAMU
Ltv9gEIABwaq7cn8hotLsgA=
=rH6i
-----END PGP SIGNATURE-----

--------------enig5CF5696B02F1F88C1C4CDB98--

This is a cryptographically signed message in MIME format.

--------------ms050505060400050600050002
Content-Type: text/plain; charset=windows-1251
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I get an incorrect md5sum for this package:

106480fe6f5d56513a4fd77592d5a8e88a9c4825
redhat/9/updates/SRPMS/mysql-3.23.58-1.90.5.legacy.src.rpm

didn't check the others...

$ md5sum mysql-3.23.58-1.90.5.legacy.src.rpm
a75573a4ce3e865f3b682ff8f65f41a7 mysql-3.23.58-1.90.5.legacy.src.rpm


Is this a mistake or the package was changed?


fedora-legacy-announce@redhat.com wrote:
> ---------------------------------------------------------------------
> Fedora Legacy Update Advisory
>
> Synopsis: Updated mysql packages fix security issues
> Advisory ID: FLSA:2129
> Issue date: 2005-03-24
> Product: Red Hat Linux, Fedora Core
> Keywords: Bugfix
> Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2129
> CVE Names: CAN-2004-0381 CAN-2004-0388 CAN-2004-0457
> CAN-2004-0835 CAN-2004-0836 CAN-2004-0837
> CAN-2004-0957 CAN-2005-0004
> ---------------------------------------------------------------------
>
>
> ---------------------------------------------------------------------
> 1. Topic:
>
> Updated mysql packages that fix various security issues are now
> available.
>
> MySQL is a multi-user, multi-threaded SQL database server.
>
> 2. Relevant releases/architectures:
>
> Red Hat Linux 7.3 - i386
> Red Hat Linux 9 - i386
> Fedora Core 1 - i386
>
> 3. Problem description:
>
> This update fixes a number of potential security problems associated
> with careless handling of temporary files. The Common Vulnerabilities
> and Exposures project (cve.mitre.org) has assigned the names
> CAN-2004-0381, CAN-2004-0388, CAN-2004-0457, and CAN-2005-0004 to these
> issues.
>
> Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked
> the CREATE/INSERT rights of the old table instead of the new one. The
> Common Vulnerabilities and Exposures project (cve.mitre.org) has
> assigned the name CAN-2004-0835 to this issue.
>
> Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect
> function. In order to exploit this issue an attacker would need to force
> the use of a malicious DNS server (CAN-2004-0836).
>
> Dean Ellis discovered that multiple threads ALTERing the same (or
> different) MERGE tables to change the UNION could cause the server to
> crash or stall (CAN-2004-0837).
>
> Sergei Golubchik discovered that if a user is granted privileges to a
> database with a name containing an underscore ("_"), the user also gains
> the ability to grant privileges to other databases with similar names
> (CAN-2004-0957).
>
> All users of mysql should upgrade to these updated packages, which
> resolve these issues.
>
> 4. Solution:
>
> Before applying this update, make sure all previously released errata
> relevant to your system have been applied.
>
> To update all RPMs for your particular architecture, run:
>
> rpm -Fvh [filenames]
>
> where [filenames] is a list of the RPMs you wish to upgrade. Only those
> RPMs which are currently installed will be updated. Those RPMs which
> are not installed but included in the list will not be updated. Note
> that you can also use wildcards (*.rpm) if your current directory *only*
> contains the desired RPMs.
>
> Please note that this update is also available via yum and apt. Many
> people find this an easier way to apply updates. To use yum issue:
>
> yum update
>
> or to use apt:
>
> apt-get update; apt-get upgrade
>
> This will start an interactive process that will result in the
> appropriate RPMs being upgraded on your system. This assumes that you
> have yum or apt-get configured for obtaining Fedora Legacy content.
> Please visit http://www.fedoralegacy.org/docs for directions on how to
> configure yum and apt-get.
>
> 5. Bug IDs fixed:
>
> http://bugzilla.fedora.us - bug #2129 - MySQL Remote Buffer Overflow
>
> 6. RPMs required:
>
> Red Hat Linux 7.3:
>
> SRPM:
> http://download.fedoralegacy.org/red...legacy.src.rpm
>
>
> i386:
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
>
> Red Hat Linux 9:
>
> SRPM:
> http://download.fedoralegacy.org/red...legacy.src.rpm
>
>
> i386:
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
>
> Fedora Core 1:
>
> SRPM:
> http://download.fedoralegacy.org/fed...legacy.src.rpm
>
>
> i386:
> http://download.fedoralegacy.org/fed...egacy.i386.rpm
>
> http://download.fedoralegacy.org/fed...egacy.i386.rpm
>
> http://download.fedoralegacy.org/fed...egacy.i386.rpm
>
> http://download.fedoralegacy.org/fed...egacy.i386.rpm
>
>
> 7. Verification:
>
> SHA1 sum Package Name
> ---------------------------------------------------------------------
>
> 04ef0f04b389f7f9fc5bb46f35f81e8503a463ba
> redhat/7.3/updates/i386/mysql-3.23.58-1.73.5.legacy.i386.rpm
> 879f133178898835609ec305988b473e7221f825
> redhat/7.3/updates/i386/mysql-devel-3.23.58-1.73.5.legacy.i386.rpm
> 9258ee1dd63f878c376a4e8a4f28e6dc8be11600
> redhat/7.3/updates/i386/mysql-server-3.23.58-1.73.5.legacy.i386.rpm
> f8dfbc8e8992bb56c1f8ba9f6917ab0fb11d0e80
> redhat/7.3/updates/SRPMS/mysql-3.23.58-1.73.5.legacy.src.rpm
> 246af76de738268375fee9c066efdabdc5a01f73
> redhat/9/updates/i386/mysql-3.23.58-1.90.5.legacy.i386.rpm
> 22b584c92e81cd29086fa2335910ba5b67d22711
> redhat/9/updates/i386/mysql-devel-3.23.58-1.90.5.legacy.i386.rpm
> 4fe21cae92371b5a3ed79858ec5432807bf2cee4
> redhat/9/updates/i386/mysql-server-3.23.58-1.90.5.legacy.i386.rpm
> 106480fe6f5d56513a4fd77592d5a8e88a9c4825
> redhat/9/updates/SRPMS/mysql-3.23.58-1.90.5.legacy.src.rpm
> 509f1caeef89bb626334be27e13c4269cc00ca75
> fedora/1/updates/i386/mysql-3.23.58-4.3.legacy.i386.rpm
> 7e0bf52038d1ccb3e56f8f2e48f32846e9cb52ec
> fedora/1/updates/i386/mysql-bench-3.23.58-4.3.legacy.i386.rpm
> 08c25d36193f30dceb4d3f81fbdd69f713fd94b7
> fedora/1/updates/i386/mysql-devel-3.23.58-4.3.legacy.i386.rpm
> 8fa58175f2d1baf7d45e8c19939928d3faa113ba
> fedora/1/updates/i386/mysql-server-3.23.58-4.3.legacy.i386.rpm
> 291ec6bb776126c3726dc7dfc067afad520300af
> fedora/1/updates/SRPMS/mysql-3.23.58-4.3.legacy.src.rpm
>
> These packages are GPG signed by Fedora Legacy for security. Our key is
> available from http://www.fedoralegacy.org/about/security.php
>
> You can verify each package with the following command:
>
> rpm --checksig -v <filename>
>
> If you only wish to verify that each package has not been corrupted or
> tampered with, examine only the sha1sum with the following command:
>
> sha1sum <filename>
>
> 8. References:
>
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0381
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0388
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0457
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0835
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0836
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0837
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0957
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2005-0004
>
> 9. Contact:
>
> The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
> project details at http://www.fedoralegacy.org
>
> ---------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
>
> --
> Fedora-legacy-announce mailing list
> Fedora-legacy-announce@redhat.com
> http://www.redhat.com/mailman/listin...egacy-announce

- --
Ventsislav Genchev
Atlantis BG, Ltd.
E-mail: vigour@atlantis.bg
phone: +35928757001


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFCQ/N8wxiN6NaquRwRAlAqAKCS6SYwI5+MdgAJN9nsKR/sXEbd+QCfbzcI
lKDXm83PRKcrNpV4mvo+Oj0=
=5CQE
-----END PGP SIGNATURE-----

--------------ms050505060400050600050002
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCS qGSIb3DQEHAQAAoIII7TCC
AtEwggI6oAMCAQICAw5P5zANBgkqhkiG9w0BAQQFADBiMQswCQ YDVQQGEwJaQTElMCMGA1UE
ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1 UEAxMjVGhhd3RlIFBlcnNv
bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDUwMzIxMDkwMz U0WhcNMDYwMzIxMDkwMzU0
WjBEMR8wHQYDVQQDExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMS EwHwYJKoZIhvcNAQkBFhJ2
aWdvdXJAYXRsYW50aXMuYmcwggEiMA0GCSqGSIb3DQEBAQUAA4 IBDwAwggEKAoIBAQDEVGhg
m1F2ZEbi6PREM15uYGSR5ZQrrVT3Ebasezt6JhQCYHlDgkTa/JqbhxzPkXbFr3ZsK+pAj8rz
Iq6QVSOzpuUYnWM892V/ey2ZxerCArE7yLsgr7MezcP1iFp/ioa3jm8yMEuv9F6AqloE2Doa
k8faJAfRddLbi2q09KFDqIF7xSK7ZlBB62PqyjY0gmyWE2O/OT4USl0ClDEdAnPXx5rI12aT
0zFBMblJI0jIHsy5RkrhEba3ictpfiIpGjK3nGFA759tAFsjuq dmPx6iqYx4pB1iBnC6odG7
2qK3tFhRM6/ju6nXFZWx9EcQ8sgI0lkEplyfQ6NUckIRpjpBAgMBAAGjLzAtM B0GA1UdEQQW
MBSBEnZpZ291ckBhdGxhbnRpcy5iZzAMBgNVHRMBAf8EAjAAMA 0GCSqGSIb3DQEBBAUAA4GB
ABLi3u49yGt51PrdDhErIP8R+qfGKoRMntKsIui+XhA4e7CGZT mEczGwu7p5MQr4+8AjzIjY
6IXUFTMbdNTRrJQdk6nCOXfhS0LQs2IreHPjyS0+Gnr+4Cyzb/5E+lNh5BauolvKU7Vukkgv
KN2jn2Cv9IrdCpDWbuHfg+CRkCWTMIIC0TCCAjqgAwIBAgIDDk/nMA0GCSqGSIb3DQEBBAUA
MGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3 VsdGluZyAoUHR5KSBMdGQu
MSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSX NzdWluZyBDQTAeFw0wNTAz
MjEwOTAzNTRaFw0wNjAzMjEwOTAzNTRaMEQxHzAdBgNVBAMTFl RoYXd0ZSBGcmVlbWFpbCBN
ZW1iZXIxITAfBgkqhkiG9w0BCQEWEnZpZ291ckBhdGxhbnRpcy 5iZzCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBAMRUaGCbUXZkRuLo9EQzXm5gZJ HllCutVPcRtqx7O3omFAJg
eUOCRNr8mpuHHM+RdsWvdmwr6kCPyvMirpBVI7Om5RidYzz3ZX 97LZnF6sICsTvIuyCvsx7N
w/WIWn+KhreObzIwS6/0XoCqWgTYOhqTx9okB9F10tuLarT0oUOogXvFIrtmUEHrY+rKN jSC
bJYTY785PhRKXQKUMR0Cc9fHmsjXZpPTMUExuUkjSMgezLlGSu ERtreJy2l+IikaMrecYUDv
n20AWyO6p2Y/HqKpjHikHWIGcLqh0bvaore0WFEzr+O7qdcVlbH0RxDyyAjSWQ SmXJ9Do1Ry
QhGmOkECAwEAAaMvMC0wHQYDVR0RBBYwFIESdmlnb3VyQGF0bG FudGlzLmJnMAwGA1UdEwEB
/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAEuLe7j3Ia3nU+t0OESs g/xH6p8YqhEye0qwi6L5e
EDh7sIZlOYRzMbC7unkxCvj7wCPMiNjohdQVMxt01NGslB2Tqc I5d+FLQtCzYit4c+PJLT4a
ev7gLLNv/kT6U2HkFq6iW8pTtW6SSC8o3aOfYK/0it0KkNZu4d+D4JGQJZMwggM/MIICqKAD
AgECAgENMA0GCSqGSIb3DQEBBQUAMIHRMQswCQYDVQQGEwJaQT EVMBMGA1UECBMMV2VzdGVy
biBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEV RoYXd0ZSBDb25zdWx0aW5n
MSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdm lzaW9uMSQwIgYDVQQDExtU
aGF3dGUgUGVyc29uYWwgRnJlZW1haWwgQ0ExKzApBgkqhkiG9w 0BCQEWHHBlcnNvbmFsLWZy
ZWVtYWlsQHRoYXd0ZS5jb20wHhcNMDMwNzE3MDAwMDAwWhcNMT MwNzE2MjM1OTU5WjBiMQsw
CQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbm cgKFB0eSkgTHRkLjEsMCoG
A1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3Vpbm cgQ0EwgZ8wDQYJKoZIhvcN
AQEBBQADgY0AMIGJAoGBAMSmPFVzVftOucqZWh5owHUEcJ3f6f +jHuy9zfVb8hp2vX8MOmHy
v1HOAdTlUAow1wJjWiyJFXCO3cnwK4Vaqj9xVsuvPAsH5/EfkTYkKhPPK9Xzgnc9A74r/rsY
Pge/QIACZNenprufZdHFKlSFD0gEf6e20TxhBEAeZBlyYLf7AgMBAA GjgZQwgZEwEgYDVR0T
AQH/BAgwBgEB/wIBADBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLnRoYXd 0ZS5jb20v
VGhhd3RlUGVyc29uYWxGcmVlbWFpbENBLmNybDALBgNVHQ8EBA MCAQYwKQYDVR0RBCIwIKQe
MBwxGjAYBgNVBAMTEVByaXZhdGVMYWJlbDItMTM4MA0GCSqGSI b3DQEBBQUAA4GBAEiM0VCD
6gsuzA2jZqxnD3+vrL7CF6FDlpSdf0whuPg2H6otnzYvwPQcUC CTcDz9reFhYsPZOhl+hLGZ
G***GguCdJ4lUJRix9sncVcljd2pnDmOjCBPZV+V2vf3h9bGCE 6u9uo05RAaWzVNd+NWIXiC
3CEZNd4ksdMdRv9dX2VPMYIDOzCCAzcCAQEwaTBiMQswCQYDVQ QGEwJaQTElMCMGA1UEChMc
VGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAx MjVGhhd3RlIFBlcnNvbmFs
IEZyZWVtYWlsIElzc3VpbmcgQ0ECAw5P5zAJBgUrDgMCGgUAoI IBpzAYBgkqhkiG9w0BCQMx
CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNTAzMjUxMT E4MjFaMCMGCSqGSIb3DQEJ
BDEWBBSYuz5voBDju+MEBw6wn9SlNfymSTBSBgkqhkiG9w0BCQ 8xRTBDMAoGCCqGSIb3DQMH
MA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDg MCBzANBggqhkiG9w0DAgIB
KDB4BgkrBgEEAYI3EAQxazBpMGIxCzAJBgNVBAYTAlpBMSUwIw YDVQQKExxUaGF3dGUgQ29u
c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUG Vyc29uYWwgRnJlZW1haWwg
SXNzdWluZyBDQQIDDk/nMHoGCyqGSIb3DQEJEAILMWugaTBiMQswCQYDVQQGEwJaQTElM CMG
A1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMC oGA1UEAxMjVGhhd3RlIFBl
cnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECAw5P5zANBgkqhk iG9w0BAQEFAASCAQCVj2N3
Jeh5Ze49jBUvv8HG7EapXVBlnSn804UcvP1SdjnrLVl6zlxxe3 VGYg+Jnj21RgS2AuICFQCq
ow4bU9USLji/k7TRMy2UnyxNlSBl1+s226yiCOuEsS+5yO9I1ufA6WePgD7UTL wfpjHkHAoY
ew6vjHdcXGCUk8D1T9NytlcILDRQl6BqlZUlK9L70neNP8OKnY q6v4IeaQz20LNzTXFmRIHx
SwWUjMHHjMYOOJvwvCYOEUGSi1+r6jHNWhqstRXYzxiQJ88Qy+ jbgfxX6cNhzk6IS8vhIJwF
+3vl/+3+KI6hoSlv5wAtiWA3tYVovjg5fjjvYM5LYZdJRmhuAAAAAAA A
--------------ms050505060400050600050002--

This is a cryptographically signed message in MIME format.

--------------ms010903040207040505000001
Content-Type: text/plain; charset=windows-1251
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ops... my mistake... sry guys... everythink is ok... i just used md5sum
instead of sha1sum ... sry again..

fedora-legacy-announce@redhat.com wrote:
> ---------------------------------------------------------------------
> Fedora Legacy Update Advisory
>
> Synopsis: Updated mysql packages fix security issues
> Advisory ID: FLSA:2129
> Issue date: 2005-03-24
> Product: Red Hat Linux, Fedora Core
> Keywords: Bugfix
> Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2129
> CVE Names: CAN-2004-0381 CAN-2004-0388 CAN-2004-0457
> CAN-2004-0835 CAN-2004-0836 CAN-2004-0837
> CAN-2004-0957 CAN-2005-0004
> ---------------------------------------------------------------------
>
>
> ---------------------------------------------------------------------
> 1. Topic:
>
> Updated mysql packages that fix various security issues are now
> available.
>
> MySQL is a multi-user, multi-threaded SQL database server.
>
> 2. Relevant releases/architectures:
>
> Red Hat Linux 7.3 - i386
> Red Hat Linux 9 - i386
> Fedora Core 1 - i386
>
> 3. Problem description:
>
> This update fixes a number of potential security problems associated
> with careless handling of temporary files. The Common Vulnerabilities
> and Exposures project (cve.mitre.org) has assigned the names
> CAN-2004-0381, CAN-2004-0388, CAN-2004-0457, and CAN-2005-0004 to these
> issues.
>
> Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked
> the CREATE/INSERT rights of the old table instead of the new one. The
> Common Vulnerabilities and Exposures project (cve.mitre.org) has
> assigned the name CAN-2004-0835 to this issue.
>
> Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect
> function. In order to exploit this issue an attacker would need to force
> the use of a malicious DNS server (CAN-2004-0836).
>
> Dean Ellis discovered that multiple threads ALTERing the same (or
> different) MERGE tables to change the UNION could cause the server to
> crash or stall (CAN-2004-0837).
>
> Sergei Golubchik discovered that if a user is granted privileges to a
> database with a name containing an underscore ("_"), the user also gains
> the ability to grant privileges to other databases with similar names
> (CAN-2004-0957).
>
> All users of mysql should upgrade to these updated packages, which
> resolve these issues.
>
> 4. Solution:
>
> Before applying this update, make sure all previously released errata
> relevant to your system have been applied.
>
> To update all RPMs for your particular architecture, run:
>
> rpm -Fvh [filenames]
>
> where [filenames] is a list of the RPMs you wish to upgrade. Only those
> RPMs which are currently installed will be updated. Those RPMs which
> are not installed but included in the list will not be updated. Note
> that you can also use wildcards (*.rpm) if your current directory *only*
> contains the desired RPMs.
>
> Please note that this update is also available via yum and apt. Many
> people find this an easier way to apply updates. To use yum issue:
>
> yum update
>
> or to use apt:
>
> apt-get update; apt-get upgrade
>
> This will start an interactive process that will result in the
> appropriate RPMs being upgraded on your system. This assumes that you
> have yum or apt-get configured for obtaining Fedora Legacy content.
> Please visit http://www.fedoralegacy.org/docs for directions on how to
> configure yum and apt-get.
>
> 5. Bug IDs fixed:
>
> http://bugzilla.fedora.us - bug #2129 - MySQL Remote Buffer Overflow
>
> 6. RPMs required:
>
> Red Hat Linux 7.3:
>
> SRPM:
> http://download.fedoralegacy.org/red...legacy.src.rpm
>
>
> i386:
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
>
> Red Hat Linux 9:
>
> SRPM:
> http://download.fedoralegacy.org/red...legacy.src.rpm
>
>
> i386:
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
> http://download.fedoralegacy.org/red...egacy.i386.rpm
>
>
> Fedora Core 1:
>
> SRPM:
> http://download.fedoralegacy.org/fed...legacy.src.rpm
>
>
> i386:
> http://download.fedoralegacy.org/fed...egacy.i386.rpm
>
> http://download.fedoralegacy.org/fed...egacy.i386.rpm
>
> http://download.fedoralegacy.org/fed...egacy.i386.rpm
>
> http://download.fedoralegacy.org/fed...egacy.i386.rpm
>
>
> 7. Verification:
>
> SHA1 sum Package Name
> ---------------------------------------------------------------------
>
> 04ef0f04b389f7f9fc5bb46f35f81e8503a463ba
> redhat/7.3/updates/i386/mysql-3.23.58-1.73.5.legacy.i386.rpm
> 879f133178898835609ec305988b473e7221f825
> redhat/7.3/updates/i386/mysql-devel-3.23.58-1.73.5.legacy.i386.rpm
> 9258ee1dd63f878c376a4e8a4f28e6dc8be11600
> redhat/7.3/updates/i386/mysql-server-3.23.58-1.73.5.legacy.i386.rpm
> f8dfbc8e8992bb56c1f8ba9f6917ab0fb11d0e80
> redhat/7.3/updates/SRPMS/mysql-3.23.58-1.73.5.legacy.src.rpm
> 246af76de738268375fee9c066efdabdc5a01f73
> redhat/9/updates/i386/mysql-3.23.58-1.90.5.legacy.i386.rpm
> 22b584c92e81cd29086fa2335910ba5b67d22711
> redhat/9/updates/i386/mysql-devel-3.23.58-1.90.5.legacy.i386.rpm
> 4fe21cae92371b5a3ed79858ec5432807bf2cee4
> redhat/9/updates/i386/mysql-server-3.23.58-1.90.5.legacy.i386.rpm
> 106480fe6f5d56513a4fd77592d5a8e88a9c4825
> redhat/9/updates/SRPMS/mysql-3.23.58-1.90.5.legacy.src.rpm
> 509f1caeef89bb626334be27e13c4269cc00ca75
> fedora/1/updates/i386/mysql-3.23.58-4.3.legacy.i386.rpm
> 7e0bf52038d1ccb3e56f8f2e48f32846e9cb52ec
> fedora/1/updates/i386/mysql-bench-3.23.58-4.3.legacy.i386.rpm
> 08c25d36193f30dceb4d3f81fbdd69f713fd94b7
> fedora/1/updates/i386/mysql-devel-3.23.58-4.3.legacy.i386.rpm
> 8fa58175f2d1baf7d45e8c19939928d3faa113ba
> fedora/1/updates/i386/mysql-server-3.23.58-4.3.legacy.i386.rpm
> 291ec6bb776126c3726dc7dfc067afad520300af
> fedora/1/updates/SRPMS/mysql-3.23.58-4.3.legacy.src.rpm
>
> These packages are GPG signed by Fedora Legacy for security. Our key is
> available from http://www.fedoralegacy.org/about/security.php
>
> You can verify each package with the following command:
>
> rpm --checksig -v <filename>
>
> If you only wish to verify that each package has not been corrupted or
> tampered with, examine only the sha1sum with the following command:
>
> sha1sum <filename>
>
> 8. References:
>
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0381
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0388
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0457
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0835
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0836
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0837
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2004-0957
> http://cve.mitre.org/cgi-bin/cvename...=CAN-2005-0004
>
> 9. Contact:
>
> The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
> project details at http://www.fedoralegacy.org
>
> ---------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
>
> --
> Fedora-legacy-announce mailing list
> Fedora-legacy-announce@redhat.com
> http://www.redhat.com/mailman/listin...egacy-announce

- --
Ventsislav Genchev
Atlantis BG, Ltd.
E-mail: vigour@atlantis.bg
phone: +35928757001


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFCQ/iDwxiN6NaquRwRAteoAKDAlPjrO5S414H09DXt+fI29XIQyQCg pAFq
3EfN2EYu9TQgc3dS8aiU3PM=
=HEwD
-----END PGP SIGNATURE-----

--------------ms010903040207040505000001
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCS qGSIb3DQEHAQAAoIII7TCC
AtEwggI6oAMCAQICAw5P5zANBgkqhkiG9w0BAQQFADBiMQswCQ YDVQQGEwJaQTElMCMGA1UE
ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1 UEAxMjVGhhd3RlIFBlcnNv
bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDUwMzIxMDkwMz U0WhcNMDYwMzIxMDkwMzU0
WjBEMR8wHQYDVQQDExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMS EwHwYJKoZIhvcNAQkBFhJ2
aWdvdXJAYXRsYW50aXMuYmcwggEiMA0GCSqGSIb3DQEBAQUAA4 IBDwAwggEKAoIBAQDEVGhg
m1F2ZEbi6PREM15uYGSR5ZQrrVT3Ebasezt6JhQCYHlDgkTa/JqbhxzPkXbFr3ZsK+pAj8rz
Iq6QVSOzpuUYnWM892V/ey2ZxerCArE7yLsgr7MezcP1iFp/ioa3jm8yMEuv9F6AqloE2Doa
k8faJAfRddLbi2q09KFDqIF7xSK7ZlBB62PqyjY0gmyWE2O/OT4USl0ClDEdAnPXx5rI12aT
0zFBMblJI0jIHsy5RkrhEba3ictpfiIpGjK3nGFA759tAFsjuq dmPx6iqYx4pB1iBnC6odG7
2qK3tFhRM6/ju6nXFZWx9EcQ8sgI0lkEplyfQ6NUckIRpjpBAgMBAAGjLzAtM B0GA1UdEQQW
MBSBEnZpZ291ckBhdGxhbnRpcy5iZzAMBgNVHRMBAf8EAjAAMA 0GCSqGSIb3DQEBBAUAA4GB
ABLi3u49yGt51PrdDhErIP8R+qfGKoRMntKsIui+XhA4e7CGZT mEczGwu7p5MQr4+8AjzIjY
6IXUFTMbdNTRrJQdk6nCOXfhS0LQs2IreHPjyS0+Gnr+4Cyzb/5E+lNh5BauolvKU7Vukkgv
KN2jn2Cv9IrdCpDWbuHfg+CRkCWTMIIC0TCCAjqgAwIBAgIDDk/nMA0GCSqGSIb3DQEBBAUA
MGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3 VsdGluZyAoUHR5KSBMdGQu
MSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSX NzdWluZyBDQTAeFw0wNTAz
MjEwOTAzNTRaFw0wNjAzMjEwOTAzNTRaMEQxHzAdBgNVBAMTFl RoYXd0ZSBGcmVlbWFpbCBN
ZW1iZXIxITAfBgkqhkiG9w0BCQEWEnZpZ291ckBhdGxhbnRpcy 5iZzCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBAMRUaGCbUXZkRuLo9EQzXm5gZJ HllCutVPcRtqx7O3omFAJg
eUOCRNr8mpuHHM+RdsWvdmwr6kCPyvMirpBVI7Om5RidYzz3ZX 97LZnF6sICsTvIuyCvsx7N
w/WIWn+KhreObzIwS6/0XoCqWgTYOhqTx9okB9F10tuLarT0oUOogXvFIrtmUEHrY+rKN jSC
bJYTY785PhRKXQKUMR0Cc9fHmsjXZpPTMUExuUkjSMgezLlGSu ERtreJy2l+IikaMrecYUDv
n20AWyO6p2Y/HqKpjHikHWIGcLqh0bvaore0WFEzr+O7qdcVlbH0RxDyyAjSWQ SmXJ9Do1Ry
QhGmOkECAwEAAaMvMC0wHQYDVR0RBBYwFIESdmlnb3VyQGF0bG FudGlzLmJnMAwGA1UdEwEB
/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAEuLe7j3Ia3nU+t0OESs g/xH6p8YqhEye0qwi6L5e
EDh7sIZlOYRzMbC7unkxCvj7wCPMiNjohdQVMxt01NGslB2Tqc I5d+FLQtCzYit4c+PJLT4a
ev7gLLNv/kT6U2HkFq6iW8pTtW6SSC8o3aOfYK/0it0KkNZu4d+D4JGQJZMwggM/MIICqKAD
AgECAgENMA0GCSqGSIb3DQEBBQUAMIHRMQswCQYDVQQGEwJaQT EVMBMGA1UECBMMV2VzdGVy
biBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEV RoYXd0ZSBDb25zdWx0aW5n
MSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdm lzaW9uMSQwIgYDVQQDExtU
aGF3dGUgUGVyc29uYWwgRnJlZW1haWwgQ0ExKzApBgkqhkiG9w 0BCQEWHHBlcnNvbmFsLWZy
ZWVtYWlsQHRoYXd0ZS5jb20wHhcNMDMwNzE3MDAwMDAwWhcNMT MwNzE2MjM1OTU5WjBiMQsw
CQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbm cgKFB0eSkgTHRkLjEsMCoG
A1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3Vpbm cgQ0EwgZ8wDQYJKoZIhvcN
AQEBBQADgY0AMIGJAoGBAMSmPFVzVftOucqZWh5owHUEcJ3f6f +jHuy9zfVb8hp2vX8MOmHy
v1HOAdTlUAow1wJjWiyJFXCO3cnwK4Vaqj9xVsuvPAsH5/EfkTYkKhPPK9Xzgnc9A74r/rsY
Pge/QIACZNenprufZdHFKlSFD0gEf6e20TxhBEAeZBlyYLf7AgMBAA GjgZQwgZEwEgYDVR0T
AQH/BAgwBgEB/wIBADBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLnRoYXd 0ZS5jb20v
VGhhd3RlUGVyc29uYWxGcmVlbWFpbENBLmNybDALBgNVHQ8EBA MCAQYwKQYDVR0RBCIwIKQe
MBwxGjAYBgNVBAMTEVByaXZhdGVMYWJlbDItMTM4MA0GCSqGSI b3DQEBBQUAA4GBAEiM0VCD
6gsuzA2jZqxnD3+vrL7CF6FDlpSdf0whuPg2H6otnzYvwPQcUC CTcDz9reFhYsPZOhl+hLGZ
G***GguCdJ4lUJRix9sncVcljd2pnDmOjCBPZV+V2vf3h9bGCE 6u9uo05RAaWzVNd+NWIXiC
3CEZNd4ksdMdRv9dX2VPMYIDOzCCAzcCAQEwaTBiMQswCQYDVQ QGEwJaQTElMCMGA1UEChMc
VGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAx MjVGhhd3RlIFBlcnNvbmFs
IEZyZWVtYWlsIElzc3VpbmcgQ0ECAw5P5zAJBgUrDgMCGgUAoI IBpzAYBgkqhkiG9w0BCQMx
CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNTAzMjUxMT M5NDhaMCMGCSqGSIb3DQEJ
BDEWBBQwi5K0Ygn/nm0OIflSYyFXfxyRtzBSBgkqhkiG9w0BCQ8xRTBDMAoGCCqGSI b3DQMH
MA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDg MCBzANBggqhkiG9w0DAgIB
KDB4BgkrBgEEAYI3EAQxazBpMGIxCzAJBgNVBAYTAlpBMSUwIw YDVQQKExxUaGF3dGUgQ29u
c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUG Vyc29uYWwgRnJlZW1haWwg
SXNzdWluZyBDQQIDDk/nMHoGCyqGSIb3DQEJEAILMWugaTBiMQswCQYDVQQGEwJaQTElM CMG
A1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMC oGA1UEAxMjVGhhd3RlIFBl
cnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECAw5P5zANBgkqhk iG9w0BAQEFAASCAQCk5g45
l6s6x5YWhqJ6IHoaEwA/d1/nov5hqJNVZk5Sw1bOYnS6GqUF9EfDPyOhVMdTNv3ocNITgksn
O3srtvv5H3/e6Kvx4UM8bU4dlWpFMUVHIUkvFYq5ckQAnnWgBFqbm7z/2TErn1wiM0mfUQWy
GYtlfQ1ZBpB4mZQw5yBGzwytfrx4+URAVSKZk0Xih4fkBoD9pe 5TWJant0IgbDpmFF+XV6mW
ALK8hELnKpaNUrpH9AN9lmJZrMAh7Rw6Kk8Ug/CD0PiI4m042dXmqOgaPIUWVvgHPYERrk9K
eTXVl+z529VS53K4kwwmsTGbdte/nSLDzsam42SBCg+O/WZbAAAAAAAA
--------------ms010903040207040505000001--