dcsimg
Linux Today: Linux News On Internet Time.




More on LinuxToday


Red Hat Security Advisory: Updated mysql packages available for Red Hat Linux 7

Jan 23, 2001, 21:08 (0 Talkback[s])

Date: Tue, 23 Jan 2001 12:00:00 -0500
From: bugzilla@REDHAT.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: [RHSA-2001:003-07] Updated mysql packages available for Red Hat Linux 7


                   Red Hat, Inc. Security Advisory

Synopsis:          Updated mysql packages available for Red Hat Linux 7
Advisory ID:       RHSA-2001:003-07
Issue date:        2001-01-18
Updated on:        2001-01-23
Product:           Red Hat Linux
Keywords:          mysql security buffer overflow
Cross references:
Obsoletes:         RHBA-2000:133  RHBA-2000:067

1. Topic:

The MySQL database that shipped with Red Hat Linux 7 and the updates for it have been reported by the MySQL authors to have security problems.

2. Relevant releases/architectures:

Red Hat Linux 7.0 - alpha, i386

3. Problem description:

The MySQL database that shipped with Red Hat Linux 7 and the updates for it have been reported by the MySQL authors to have security problems.

These problems (buffer overflow and information protection issues) have been fixed in version 3.23.32, which also contains the earlier fixes.

Note that MySQL has updated its client library since the initial version shipped with Red Hat Linux 7. A new package, mysqlclient9, must be used for running applications linked with the libmysqlclient.so.9 library.

4. Solution:

Because of dependencies, the packages must be installed as a group.

After downloading all RPMs needed for your particular architecture, run:

rpm -Uvh mysql*

Note that in rare cases, the shutdown of the old database fails after upgrade - to ensure a smooth upgrade, shut the database down before upgrading:

service mysqld stop

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

24381 - Buffer Overflow in MySQL <3.23.31
22649 - encrypt() function not supported
24589 - mysql logrotate script returns an error, log doesn't get rotated

6. RPMs required:

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/SRPMS/mysql-3.23.32-1.7.src.rpm
ftp://updates.redhat.com/7.0/SRPMS/mysqlclient9-3.23.22-3.src.rpm

alpha:
ftp://updates.redhat.com/7.0/alpha/mysql-3.23.32-1.7.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/mysql-devel-3.23.32-1.7.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/mysql-server-3.23.32-1.7.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/mysqlclient9-3.23.22-3.alpha.rpm

i386:
ftp://updates.redhat.com/7.0/i386/mysql-3.23.32-1.7.i386.rpm
ftp://updates.redhat.com/7.0/i386/mysql-devel-3.23.32-1.7.i386.rpm
ftp://updates.redhat.com/7.0/i386/mysql-server-3.23.32-1.7.i386.rpm
ftp://updates.redhat.com/7.0/i386/mysqlclient9-3.23.22-3.i386.rpm

7. Verification:

MD5 sum                           Package Name

1d13ef56b8898abf8841510db3c0be49 7.0/SRPMS/mysql-3.23.32-1.7.src.rpm
f538d811ec522c86ab890657e859a4f4 7.0/SRPMS/mysqlclient9-3.23.22-3.src.rpm
c838e7245d2ca45357e556317873fcca 7.0/alpha/mysql-3.23.32-1.7.alpha.rpm
5a5049769bd785e800fe629c7875dec8 7.0/alpha/mysql-devel-3.23.32-1.7.alpha.rpm
5cb73bca58042bb7604361c224878f08 7.0/alpha/mysql-server-3.23.32-1.7.alpha.rpm
e5f65a87cb3e019456d842d565693476 7.0/alpha/mysqlclient9-3.23.22-3.alpha.rpm
d8097aa8c188b386803267446286a01a 7.0/i386/mysql-3.23.32-1.7.i386.rpm
528a72c7b017458f6cad65978b93305e 7.0/i386/mysql-devel-3.23.32-1.7.i386.rpm
8ec7d8b903e1608de50f49196837e40c 7.0/i386/mysql-server-3.23.32-1.7.i386.rpm
38a96abb2b68fa9354f715da47767386 7.0/i386/mysqlclient9-3.23.22-3.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key is available at:
http://www.redhat.com/corp/contact.html

You can verify each package with the following command:
rpm --checksig <filename>

If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>

8. References:

http://www.mysql.com/documentation/mysql/bychapter/manual_News.html#News-3.23.31

Copyright(c) 2000, 2001 Red Hat, Inc.