Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.1799
mysql-5.5 security update
17 December 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: mysql-5.5
Publisher: Debian
Operating System: Debian GNU/Linux 7
Impact/Access: Access Confidential Data -- Existing Account
Unauthorised Access -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2013-5807 CVE-2013-3839 CVE-2013-3812
CVE-2013-3809 CVE-2013-3804 CVE-2013-3802
CVE-2013-3793 CVE-2013-3783 CVE-2013-2162
CVE-2013-1861
Reference: ASB-2013.0113
ASB-2013.0086
ESB-2013.1484
Original Bulletin:
http://www.debian.org/security/2013/dsa-2818
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2818-1 security@debian.org
http://www.debian.org/security/ Salvatore Bonaccorso
December 16, 2013 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : mysql-5.5
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2013-1861 CVE-2013-2162 CVE-2013-3783 CVE-2013-3793
CVE-2013-3802 CVE-2013-3804 CVE-2013-3809 CVE-2013-3812
CVE-2013-3839 CVE-2013-5807
Debian Bug : 711600 732306
Several issues have been discovered in the MySQL database server. The
vulnerabilities are addressed by upgrading MySQL to a new upstream
version, 5.5.33, which includes additional changes, such as performance
improvements, bug fixes, new features, and possibly incompatible
changes. Please see the MySQL 5.5 Release Notes for further details:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-33.html
In addition this update fixes two issues affecting specifically the
mysql-5.5 Debian package:
A race condition in the post-installation script of the mysql-server-5.5
package creates the configuration file "/etc/mysql/debian.cnf" with
world-readable permissions before restricting the permissions, which
allows local users to read the file and obtain sensitive information
such as credentials for the debian-sys-maint to perform
administration tasks. (CVE-2013-2162)
Matthias Reichl reported that the mysql-5.5 package misses the patches
applied previous in Debian's mysql-5.1 to drop the database "test" and
the permissions that allow anonymous access, without a password, from
localhost to the "test" database and any databases starting with
"test_". This update reintroduces these patches for the mysql-5.5
package.
Existing databases and permissions are not touched. Please refer to the
NEWS file provided with this update for further information.
For the stable distribution (wheezy), these problems have been fixed in
version 5.5.33+dfsg-0+wheezy1.
For the unstable distribution (sid), the Debian specific problems will
be fixed soon.
We recommend that you upgrade your mysql-5.5 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
iQIcBAEBCgAGBQJSryLPAAoJEAVMuPMTQ89EcUgP/3rFEb0ydpw8hOvzrXHqzPUR
YYAXDJbXwhGhh280DeYOFkDu5Xd28LYWsne0o+gwd+Csp2Q3lcVfzULUb3j7ddl1
Jlfd5FxXFTcIPXqVo6RmOgf7GOl77bg+sCeIqNrjaPBsBIzZQmoTHjfXQTKqKiZF
WMwMnIVoeCdY23LYosnel5MXfiHaPpqGDhUkeoFnJ4m2+hfvHbM3Pj+3IjgwAvF+
p0tiMfvjJ9muVsj4xDnGk9z4JlDONoohqiv5mtL2NNY6bV6T6aTo74SadnKsp6dU
ug0KeuwDtVe7l1Mzq8O0qCJHEEfHfZ1IsvoPAwndN8yqXbHQ8pU/9vyz+5LxGb6z
VkGkGVzypSI8u6B+zGYBa54zrKO5DaS/YAlKU+wkWSdH9RcdMoHTYOlMBh8wQXoW
mfnIZ6V4pv1Usm5xiZpQU6BrJaWWyDqZPdlK8oLplKkKJFHsQz7tjZylO64HGR3X
tEu8qjfWblPR37gWY3FRErN1zIDiRzt6LK67achBdCZ4WxG18f2KQRDbgZzx5n9Z
lblYgEYFK1EXE5rutHe9nwKkDS9DfSRuybty6WCqcmLBEIu8vDoHbDXR683UNsCT
84AwQrv7/QfugQHWpEA7nabDprrKK9TM3hjdQjqlelX3/kLpAQYkTxDSJ6uINH0H
gubK4/5nmK0zX7OoNwWt
=5UEA
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUq+dVBLndAQH1ShLAQLAgQ/9GF1L7F3pePllYFzbUlXncp1vcI9XVuKo
lN2OmS8V8wXgIeYOYlkoc/JfCFd1s5N+5apdjp+1/EiKXEnp1iUG+Ao6ZGgADM96
iEwspOL72hHJ0UntF1d++shmgDHLv+y9sKI42Ci6k5iWikeDZIVstCCtML9gVEVO
P5AzhjhPxv5A9x0Kh2G9vSzzXkk/HZ1hT1Ba1RKleZQ8oOZD3LySJyrELYH2YT1Y
oviLxCpwIVxGSk+cBYiKCFnV9+urqiXdQ7H43scsf+w2ilshbfROkN2mkhihDEFB
cb8fSJcsyLv45HwXahNdcvMW+0Km5h4WVSnJZJ/+/rxy9TG8xUhlEDMLd/UvXhda
L+1gGnhWLjpVCp35TZnGT/mqqJXlcywHLWO2qzpJC7yQ/ahB4bm1SZUnvPpG53eS
8ivtVlxOf60jA+6L2jTRnn3BKbCPWJBFwB07nRUHjooeWC5TDpfhqtyt+DUQSnqA
leKKnFIiIcwZwrFXWN2uEAs7l1dEAbnJDO6AYkNGmvxnVehgiX4D3QeOnYteZy+r
5DNcJQG2EiCPQVj8ziqqG6G907USfrmjGoZUJM0GVMUrREs+U23XlW732z4yPT10
ZKvNJ5wmtW4F6cge1MMZVAT0jIVZfF5PZGe51V1vTkSZvUK8ahIhhms3h/HMh8Xa
+iNlrnXxknM=
=Tupw
-----END PGP SIGNATURE-----