Your message dated Wed, 02 Feb 2005 20:32:29 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#293345: fixed in mysql-dfsg-4.1 4.1.9-2
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 2 Feb 2005 16:56:47 +0000
>From [EMAIL PROTECTED] Wed Feb 02 08:56:47 2005
Return-path: <[EMAIL PROTECTED]>
Received: from turing.cs.hmc.edu [134.173.42.99]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CwNo7-00023A-00; Wed, 02 Feb 2005 08:56:47 -0800
Received: by turing.cs.hmc.edu (Postfix, from userid 20007)
id D991453304; Wed, 2 Feb 2005 08:56:46 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
by turing.cs.hmc.edu (Postfix) with ESMTP id C27E75A92A
for <[EMAIL PROTECTED]>; Wed, 2 Feb 2005 08:56:46 -0800 (PST)
Date: Wed, 2 Feb 2005 08:56:46 -0800 (PST)
From: Matt Brubeck <[EMAIL PROTECTED]>
Sender: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: mysql: File owned by mysql is run by root
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: mysql-server
Version: 4.0.23-3
Severity: critical
Tags: security, sarge, sid
A privilege escalation vulnerability was introduced in mysql-sever
4.0.23-1.
The following file is run as root by /etc/init.d/mysql (it is sourced by
/etc/mysql/debian-start):
/usr/share/mysql/debian-start.inc.sh
This file and its containing directory are owned by the "mysql" user.
An attacker with access to the "mysql" account could change this file to
contain arbitrary commands, which would be run as root whenever
mysql-server is started (including at system boot).
---------------------------------------
Received: (at 293345-close) by bugs.debian.org; 3 Feb 2005 01:38:12 +0000
>From [EMAIL PROTECTED] Wed Feb 02 17:38:11 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CwVwh-0006Pz-00; Wed, 02 Feb 2005 17:38:11 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1CwVrB-0006b9-00; Wed, 02 Feb 2005 20:32:29 -0500
From: Christian Hammers <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#293345: fixed in mysql-dfsg-4.1 4.1.9-2
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Wed, 02 Feb 2005 20:32:29 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 3
Source: mysql-dfsg-4.1
Source-Version: 4.1.9-2
We believe that the bug you reported is fixed in the latest version of
mysql-dfsg-4.1, which is due to be installed in the Debian FTP archive:
libmysqlclient14-dev_4.1.9-2_i386.deb
to pool/main/m/mysql-dfsg-4.1/libmysqlclient14-dev_4.1.9-2_i386.deb
libmysqlclient14_4.1.9-2_i386.deb
to pool/main/m/mysql-dfsg-4.1/libmysqlclient14_4.1.9-2_i386.deb
mysql-client-4.1_4.1.9-2_i386.deb
to pool/main/m/mysql-dfsg-4.1/mysql-client-4.1_4.1.9-2_i386.deb
mysql-common-4.1_4.1.9-2_all.deb
to pool/main/m/mysql-dfsg-4.1/mysql-common-4.1_4.1.9-2_all.deb
mysql-dfsg-4.1_4.1.9-2.diff.gz
to pool/main/m/mysql-dfsg-4.1/mysql-dfsg-4.1_4.1.9-2.diff.gz
mysql-dfsg-4.1_4.1.9-2.dsc
to pool/main/m/mysql-dfsg-4.1/mysql-dfsg-4.1_4.1.9-2.dsc
mysql-server-4.1_4.1.9-2_i386.deb
to pool/main/m/mysql-dfsg-4.1/mysql-server-4.1_4.1.9-2_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Christian Hammers <[EMAIL PROTECTED]> (supplier of updated mysql-dfsg-4.1
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Wed, 2 Feb 2005 23:31:55 +0100
Source: mysql-dfsg-4.1
Binary: libmysqlclient14-dev mysql-common-4.1 libmysqlclient14 mysql-server-4.1
mysql-client-4.1
Architecture: source i386 all
Version: 4.1.9-2
Distribution: unstable
Urgency: high
Maintainer: Christian Hammers <[EMAIL PROTECTED]>
Changed-By: Christian Hammers <[EMAIL PROTECTED]>
Description:
libmysqlclient14 - mysql database client library
libmysqlclient14-dev - mysql database development files
mysql-client-4.1 - mysql database client binaries
mysql-common-4.1 - mysql database common files (e.g. /etc/mysql/my.cnf)
mysql-server-4.1 - mysql database server binaries
Closes: 287735 291300 293345
Changes:
mysql-dfsg-4.1 (4.1.9-2) unstable; urgency=high
.
* SECURITY:
For historical reasons /usr/share/mysql/ was owned and writable by
the user "mysql". This is a security problem as some scripts that
are run by root are in this directory and could be modified and used
by a malicious user who already has mysql privileges to gain full root
rights (thanks to Matt Brubeck). Closes: #293345
* Changed "skip-networking" to "bind-address 127.0.0.1" which is more
compatible and not less secure but maybe even more, as less people enable
networking for all interfaces (thanks to Arjen Lentz).
* Enabled InnoDB by default as recommended by Arjen Lentz from MySQL.
* Added remarks about hosts.allow to README.Debian (thanks to David
Chappell). Closes: #291300
* mysql-server-4.1 now provides mysql-server (thanks to Paul van den Berg).
Closes: #287735
Files:
3a6f872a6fc927a99eff3ddfe3c05c7d 974 misc optional mysql-dfsg-4.1_4.1.9-2.dsc
1691936d4c01d641aafc1e9eb0d7a0a6 149099 misc optional
mysql-dfsg-4.1_4.1.9-2.diff.gz
8db8adaa815bd8633651a54002b4773f 31738 misc optional
mysql-common-4.1_4.1.9-2_all.deb
a7836165fb55586f6390f16fa811e765 1407552 libs optional
libmysqlclient14_4.1.9-2_i386.deb
4c22cad226cefc8aeb8d935e03a2c399 2513334 libdevel optional
libmysqlclient14-dev_4.1.9-2_i386.deb
0664652fa85dda62d8c98950849a38bd 823816 misc optional
mysql-client-4.1_4.1.9-2_i386.deb
8699a0b4526216a3aaa5e49c7dd2ae22 14509954 misc optional
mysql-server-4.1_4.1.9-2_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iEYEARECAAYFAkIBduQACgkQkR9K5oahGOaqAgCeIhH6Sr4h/4LokPZxWzDs+n79
8kgAn2TcuKGxt0ZX2K1PXl1otxy7WBAe
=Q8TZ
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
