Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Full-disclosure] rPSA-2006-0089-1 mysql mysql-bench mysql-server

from [Justin M. Forbes] Network Security [Permanent Link]
Subject: [Full-disclosure] rPSA-2006-0089-1 mysql mysql-bench mysql-server
Date: Thu, 01 Jun 2006 15:05:33 -0400 
rPath Security Advisory: 2006-0089-1
Published: 2006-06-01
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
    Local System User Deterministic Vulnerability
Updated Versions:
    mysql=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1
    mysql-bench=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1
    mysql-server=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2753
    http://issues.rpath.com/browse/RPL-396
    http://lists.mysql.com/announce/364

Description:
    Previous versions of mysql server and client libraries contain
    weaknesses parsing certain character encodings (such as SJIS,
    BIG5 and GBK, but not ASCII) which, when using the vulnerable
    encodings, can enable SQL injection attacks against applications
    (particularly web applications) which use non-standard escaping of
    quote characters.
    
    Because vulnerable escaping of quote characters is no longer allowed,
    some existing applications may not function correctly when used with
    the new release of mysql.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Full-disclosure] rPSA-2006-0089-1 mysql mysql-bench mysql-server, Justin M. Forbes <=
Previous by Date:  Re: [Full-disclosure] Different google interface when using some Tor exit nodes, Dean Pierce
Next by Date:  [Full-disclosure] VMSA-2006-0001 - VMware ESX Server Cross Site Scripting issue, VMware Security Team
Previous by Thread:  [Full-disclosure] [ MDKSA-2006:094 ] - Updated evolution packages fix DoS (crash) vulnerability on certain messages., security
Next by Thread:  [Full-disclosure] VMSA-2006-0001 - VMware ESX Server Cross Site Scripting issue, VMware Security Team
Indexes:  [Date] [Thread] [Top] [All Lists]