Bug 592079 (CVE-2010-1848)
| Summary: | CVE-2010-1848 mysql: multiple insufficient table name checks | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Vincent Danen <vdanen> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | unspecified | CC: | byte, hhorak, kvolny | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 915890 (view as bug list) | Environment: | |||||
| Last Closed: | 2015-07-29 14:19:11 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 590598, 592862, 592874, 592875, 645637, 645638, 833942, 915890, 984994, 985414 | ||||||
| Bug Blocks: | |||||||
| Attachments: |
|
||||||
|
Description
Vincent Danen
2010-05-13 19:45:41 UTC
Upstream commits that reference upstream bug, both 5.0 and 5.1 branches: http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0-bugteam/revision/2861 http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.1-bugteam/revision/3367 The two issues described in the upstream release notes as quote in comment #0 seem unrelated, they are the same type of flaw, but affect different versions and impacts are quite different too: - COM_FIELD_LIST issue - allows authenticated user to get info about fields of any table in any database via directory traversal. As info returned in response to COM_FIELD_LIST is limited to table structure info, which significantly limits the impact of the flaw. This affect pre-5.0 versions too. - There is additional instance of the similar problem in 5.1+, but it allows authenticated user to read or modify arbitrary table. Example based on upstream test cases: SELECT * FROM `../mysql/user`; Created attachment 415407 [details] Patch backported to 5.0.77, EL5 http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0-bugteam/revision/2861 Note: needs to be applied after CVE-2010-1850 fix. Statement: The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw for Red Hat Enterprise Linux 3 and 4 mysql packages. mysql-5.1.47-1.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/mysql-5.1.47-1.fc12 mysql-5.1.47-1.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/mysql-5.1.47-1.fc13 mysql-5.1.47-1.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/mysql-5.1.47-1.fc11 This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2010:0442 https://rhn.redhat.com/errata/RHSA-2010-0442.html mysql-5.1.47-1.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. mysql-5.1.47-1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. mysql-5.1.47-1.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2010:0824 https://rhn.redhat.com/errata/RHSA-2010-0824.html |