Gentoo Linux Security Advisory GLSA 200405-20
Severity: Normal
Title: Insecure Temporary File Creation In MySQL
Date: May 25, 2004
Bugs: #46242
ID: 200405-20
Synopsis
Two MySQL utilities create temporary files with hardcoded paths,
allowing an attacker to use a symlink to trick MySQL into
overwriting important data.
Background
MySQL is a popular open-source multi-threaded, multi-user SQL
database server.
Affected packages
Package / Vulnerable / Unaffected
1 dev-db/mysql < 4.0.18-r2 >= 4.0.18-r2
Description
The MySQL bug reporting utility (mysqlbug) creates a temporary
file to log bug reports to. A malicious local user with write
access to the /tmp directory could create a symbolic link of the
name mysqlbug-N pointing to a protected file, such as /etc/passwd,
such that when mysqlbug creates the Nth log file, it would end up
overwriting the target file. A similar vulnerability exists with
the mysql_multi utility, which creates a temporary file called
mysql_multi.log.
Impact
Since mysql_multi runs as root, a local attacker could use this
to destroy any other users’ data or corrupt and destroy system
files.
Workaround
One could modify both scripts to log to a directory that users
do not have write permission to, such as /var/log/mysql/.
Resolution
All users should upgrade to the latest stable version of
MySQL.
# emerge sync
# emerge -pv ">=dev-db/mysql-4.0.18-r2"
# emerge ">=dev-db/mysql-4.0.18-r2"
References
[ 1 ] CAN-2004-0381
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0381
[ 2 ] CAN-2004-0388
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0388
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200405-20.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Technologies, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/1.0
Gentoo Linux Security Advisory GLSA 200405-19
Severity: Normal
Title: Opera telnet URI handler file creation/truncation
vulnerability
Date: May 25, 2004
Bugs: #50857
ID: 200405-19
Synopsis
A vulnerability exists in Opera’s telnet URI handler that may
allow a remote attacker to overwrite arbitrary files.
Background
Opera is a multi-platform web browser.
Affected packages
Package / Vulnerable / Unaffected
1 net-www/opera < 7.50_beta1 >= 7.50_beta1
Description
The telnet URI handler in Opera does not check for leading ‘-‘
characters in the host name. Consequently, a maliciously-crafted
telnet:// link may be able to pass options
to the telnet program itself. One example would be the
following:
telnet://-nMyFile
If MyFile exists in the user’s home directory and the user
clicking on the link has write permissions to it, the contents of
the file will be overwritten with the output of the telnet trace
information. If MyFile does not exist, the file will be created in
the user’s home directory.
Impact
This exploit has two possible impacts. First, it may create new
files in the user’s home directory. Second, and far more serious,
it may overwrite existing files that the user has write permissions
to. An attacker with some knowledge of a user’s home directory
might be able to destroy important files stored within.
Workaround
Disable the telnet URI handler from within Opera.
Resolution
All Opera users are encouraged to upgrade to the latest version
of the program:
# emerge sync
# emerge -pv ">=net-www/opera-7.50_beta1"
# emerge ">=net-www/opera-7.50_beta1"
References
[ 1 ] iDEFENSE Security Advisory 05.12.04
http://www.idefense.com/application/poi/display?id=104&type=vulnerabilities&flashstatus=true
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200405-19.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Technologies, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.