Date: Thu, 25 Jan 2001 16:22:04 -0200
Subject: [CLA-2001:375] Conectiva Linux Security Announcement -
CONECTIVA LINUX SECURITY ANNOUNCEMENT
PACKAGE : MySQL
SUMMARY : Remote exploit
DATE : 2001-01-25 15:38:00
ID : CLA-2001:375
RELEASES : 4.0, 4.0es, 4.1, 4.2, 5.0, 5.1, 6.0
MySQL is a very popular database. Versions older than 3.23.31 have
a buffer overflow vulnerability that could be exploited remotely
depending on how the database access is configured (via web, for
It is recommended that all MySQL users update their packages
Older versions of Conectiva Linux ran the mysqld daemon as root.
This update changes that behaviour for these older versions so that
the daemon now runs as the "mysql" user instead of root. CL6.0
already has this feature. Users upgrading older versions should
check the /var/lib/mysql directory for permissions for the mysql
user. Usually, a "chown -R mysql.mysql /var/lib/mysql" should be
enough. Also, programs using the dynamic library of MySQL should be
recompiled after this update.
Users of Conectiva Linux version 6.0 or higher may use apt to
- add the following line to /etc/apt/sources.list if it is not
there yet (you may also use linuxconf to do this):
Some of the products that appear on this site are from companies from which QuinStreet receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. QuinStreet does not include all companies or all types of products available in the marketplace.