SOT Linux Advisory: mysql

[ Thanks to SOT Linux
Security Team for this link. ]

---------------------------------------------------------------------
                   SOT Linux Security Advisory

Subject:           Updated mysql package for SOT Linux 2002
Advisory ID:       SLSA-2003:5
Date:              Saturday, January 18, 2003
Product:           SOT Linux 2002
---------------------------------------------------------------------

1. Problem description

Multiple security vulnerabilities (DoS, privilege escalation,
arbitrary code execution) were discovered in MySQL code.
For detailed information please check links below.
Users of MySQL are advised to update vulnerable packages.


2. Updated packages

SOT Linux 2002 Server:

i386:
ftp://ftp.sot.com/updates/2002/Server/i386/mysql-3.23.54a-3.i386.rpm
ftp://ftp.sot.com/updates/2002/Server/i386/mysql-server-3.23.54a-3.i386.rpm
ftp://ftp.sot.com/updates/2002/Server/i386/mysql-devel-3.23.54a-3.i386.rpm

SRPMS:
ftp://ftp.sot.com/updates/2002/Server/SRPMS/mysql-3.23.54a-3.src.rpm


3. Upgrading package

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Use up2date to automatically upgrade the fixed packages.

If you want to upgrade manually, download the updated package from
the SOT Linux FTP site (use the links above) or from one of our mirrors.
The list of mirrors can be obtained at www.sot.com/en/linux

Update the package with the following command:
rpm -Uvh 


4. Verification

All packages are PGP signed by SOT for security.

You can verify each package with the following command:
rpm --checksig 

If you wish to verify the integrity of the downloaded package, run
"md5sum " and compare the output with data given below.


Package Name                         MD5 sum
---------------------------------------------------------------------
/Server/i386/mysql-3.23.54a-3.i386.rpm        3c595eef4f18c1e4deaf441910c94379
/Server/i386/mysql-server-3.23.54a-3.i386.rpm 57bf2c9661d2c4e9f8e71f8d5b6778fa
/Server/i386/mysql-devel-3.23.54a-3.i386.rpm  6482053f7ca09270eb1af66fae9a7571
/Server/SRPMS/mysql-3.23.54a-3.src.rpm        1dc6cb3efb80ba376c8814164734510c


5. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1373
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1374
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1375
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1376
http://marc.theaimsgroup.com/?l=bugtraq&m=103971644013961&w=2

Copyright(c) 2001, 2002 SOT