Bug 248553 (CVE-2007-3781, CVE-2007-3782)
| Summary: | CVE-2007-3781 CVE-2007-3782 New release of MySQL fixes security bugs | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Red Hat Product Security <security-response-team> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | jlieskov, pep, tao, tgl, vdanen |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-45.html | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-12-22 22:13:49 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 282471, 372881 | ||
| Bug Blocks: | |||
The Red Hat Security Response Team has rated this issue as having low security impact. We do not intend to issue an asynchronous security update to correct this flaw at this time, but will look to include a fix for this issue if we decide to update MySQL in the future (for example for an Update release or to fix issues of higher severity). *** Bug 254109 has been marked as a duplicate of this bug. *** *** Bug 254107 has been marked as a duplicate of this bug. *** Upstream bug reports: CVE-2007-3781 - http://bugs.mysql.com/bug.php?id=25578 CVE-2007-3782 - http://bugs.mysql.com/bug.php?id=27878 CVE-2007-3781 affects MySQL versions as shipped in Red Hat Enterprise Linux 4 and 5. It only allows authenticated database users to obtain information about structure of the table (CREATE TABLE SQL statement that can be used to re-create table, without data inside table) of some other user. CVE-2007-3782 only affects MySQL version as shipped in Red Hat Enterprise Linux 5. Previous versions of MySQL (prior to 5.0) do not support views. Reporter changed to security-response-team by request of Jay Turner. Both CVE-2007-3781 and CVE-2007-3782 were addressed via: Red Hat Application Stack v1 for Enterprise Linux AS (v.4) (RHSA-2007:0894) Red Hat Enterprise Linux version 5 (RHSA-2008:0364) |
Description of problem: CVE-2007-3781 Table structure can be seen by an auhenticated user w/o SELECT privilege on that table. impact=low,source=cve,reported=20070717,public=20070704 CVE-2007-3782 Use of view overrides column update privileges on underlying table impact=low,source=cve,reported=20070716,public=20070417