Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) "inputbuffer& operator>>" in yasslimp.cpp.

The vioverifycallback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7247 to the following vulnerability:

sql/sqltable.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink.

References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7247 http://lists.mysql.com/commits/59711 http://marc.info/?l=oss-security&m=125908040022018&w=2 http://bugs.mysql.com/bug.php?id=39277

Upstream patch: --------------- http://lists.mysql.com/commits/59711

Multiple denial of service flaws were found in MySQL SQL database server. Quoting from upstream 5.0.88 release notes:

Error handling was missing for SELECT statements containing subqueries in the WHERE clause and that assigned a SELECT result to a user variable. The server could crash as a result. (Bug#48291)

If the first argument to GeomFromWKB() function was a geometry value, the function just returned its value. However, it failed to preserve the argument's nullvalue flag, which caused an unexpected NULL value to be returned to the caller, resulting in a server crash. (Bug#47780)

References: ----------- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html (there are more DoS issues mentioned in the release notes, but this CVE was assigned to these two)

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html http://bugs.mysql.com/47780 http://bugs.mysql.com/48291

Upstream patches: ----------------- For Bug #48291 crash with row() operator,select into @var, and subquery returning multiple rows: http://lists.mysql.com/commits/88409 http://lists.mysql.com/commits/88741

For Bug #47780: crash when comparing GIS items from subquery: http://lists.mysql.com/commits/87591 http://lists.mysql.com/commits/88069

A denial of service flaw was found in the way MySQL processed EXPLAIN statements for SQL queries of the form:

SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)

A remote authenticated MySQL user could use this flaw to cause mysqld deamon crash (dereference NULL pointer).

References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html

Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=52711

Upstream changesets: [4] http://lists.mysql.com/commits/105750 [5] http://lists.mysql.com/commits/112043

Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.

A denial of service flaw was found in the way MySQL processed joins queries, which involved a table with unique SET column. A remote MySQL user could use this flaw to cause mysqld daemon crash.

References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html

Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54575

Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.

MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing informationschema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function.