Date: Tue, 23 Jan 2001 12:00:00 -0500
From: bugzilla@REDHAT.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: [RHSA-2001:003-07] Updated mysql packages available for
Red Hat Linux 7
Red Hat, Inc. Security Advisory
Synopsis: Updated mysql packages available for Red Hat Linux 7
Advisory ID: RHSA-2001:003-07
Issue date: 2001-01-18
Updated on: 2001-01-23
Product: Red Hat Linux
Keywords: mysql security buffer overflow
Cross references:
Obsoletes: RHBA-2000:133 RHBA-2000:067
1. Topic:
The MySQL database that shipped with Red Hat Linux 7 and the
updates for it have been reported by the MySQL authors to have
security problems.
2. Relevant releases/architectures:
Red Hat Linux 7.0 – alpha, i386
3. Problem description:
The MySQL database that shipped with Red Hat Linux 7 and the
updates for it have been reported by the MySQL authors to have
security problems.
These problems (buffer overflow and information protection
issues) have been fixed in version 3.23.32, which also contains the
earlier fixes.
Note that MySQL has updated its client library since the initial
version shipped with Red Hat Linux 7. A new package, mysqlclient9,
must be used for running applications linked with the
libmysqlclient.so.9 library.
4. Solution:
Because of dependencies, the packages must be installed as a
group.
After downloading all RPMs needed for your particular
architecture, run:
rpm -Uvh mysql*
Note that in rare cases, the shutdown of the old database fails
after upgrade – to ensure a smooth upgrade, shut the database down
before upgrading:
service mysqld stop
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla
for more info):
24381 – Buffer Overflow in MySQL <3.23.31
22649 – encrypt() function not supported
24589 – mysql logrotate script returns an error, log doesn’t get
rotated
6. RPMs required:
Red Hat Linux 7.0:
SRPMS:
ftp://updates.redhat.com/7.0/SRPMS/mysql-3.23.32-1.7.src.rpm
ftp://updates.redhat.com/7.0/SRPMS/mysqlclient9-3.23.22-3.src.rpm
alpha:
ftp://updates.redhat.com/7.0/alpha/mysql-3.23.32-1.7.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/mysql-devel-3.23.32-1.7.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/mysql-server-3.23.32-1.7.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/mysqlclient9-3.23.22-3.alpha.rpm
i386:
ftp://updates.redhat.com/7.0/i386/mysql-3.23.32-1.7.i386.rpm
ftp://updates.redhat.com/7.0/i386/mysql-devel-3.23.32-1.7.i386.rpm
ftp://updates.redhat.com/7.0/i386/mysql-server-3.23.32-1.7.i386.rpm
ftp://updates.redhat.com/7.0/i386/mysqlclient9-3.23.22-3.i386.rpm
7. Verification:
MD5 sum Package Name
1d13ef56b8898abf8841510db3c0be49 7.0/SRPMS/mysql-3.23.32-1.7.src.rpm f538d811ec522c86ab890657e859a4f4 7.0/SRPMS/mysqlclient9-3.23.22-3.src.rpm c838e7245d2ca45357e556317873fcca 7.0/alpha/mysql-3.23.32-1.7.alpha.rpm 5a5049769bd785e800fe629c7875dec8 7.0/alpha/mysql-devel-3.23.32-1.7.alpha.rpm 5cb73bca58042bb7604361c224878f08 7.0/alpha/mysql-server-3.23.32-1.7.alpha.rpm e5f65a87cb3e019456d842d565693476 7.0/alpha/mysqlclient9-3.23.22-3.alpha.rpm d8097aa8c188b386803267446286a01a 7.0/i386/mysql-3.23.32-1.7.i386.rpm 528a72c7b017458f6cad65978b93305e 7.0/i386/mysql-devel-3.23.32-1.7.i386.rpm 8ec7d8b903e1608de50f49196837e40c 7.0/i386/mysql-server-3.23.32-1.7.i386.rpm 38a96abb2b68fa9354f715da47767386 7.0/i386/mysqlclient9-3.23.22-3.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our
key is available at:
http://www.redhat.com/corp/contact.html
You can verify each package with the following command:
rpm –checksig <filename>
If you only wish to verify that each package has not been
corrupted or tampered with, examine only the md5sum with the
following command:
rpm –checksig –nogpg <filename>
8. References:
http://www.mysql.com/documentation/mysql/bychapter/manual_News.html#News-3.23.31
Copyright(c) 2000, 2001 Red Hat, Inc.