rPath alert rPSA-2006-0089-1 (mysql)

From:
    	     
 
"Justin M. Forbes" <jmforbes@rpath.com>
To:
    	     
 
security-announce@lists.rpath.com, update-announce@lists.rpath.com
Subject:
    	     
 
rPSA-2006-0089-1 mysql mysql-bench mysql-server
Date:
    	     
 
Thu, 01 Jun 2006 15:05:33 -0400
Cc:
    	     
 
full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com, lwn@lwn.net
rPath Security Advisory: 2006-0089-1
Published: 2006-06-01
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
    Local System User Deterministic Vulnerability
Updated Versions:
    mysql=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1
    mysql-bench=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1
    mysql-server=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200...
    http://issues.rpath.com/browse/RPL-396
    http://lists.mysql.com/announce/364

Description:
    Previous versions of mysql server and client libraries contain
    weaknesses parsing certain character encodings (such as SJIS,
    BIG5 and GBK, but not ASCII) which, when using the vulnerable
    encodings, can enable SQL injection attacks against applications
    (particularly web applications) which use non-standard escaping of
    quote characters.
    
    Because vulnerable escaping of quote characters is no longer allowed,
    some existing applications may not function correctly when used with
    the new release of mysql.