Red Hat Linux Security Advisory
back



Synopsis	Updated mysql packages available for Red Hat Linux 7

Advisory ID	RHSA-2001:003-07

Issue Date	2001-01-18

Updated On	2001-01-23

Product	Red Hat Linux

Keywords	mysql security buffer overflow

Cross References

Obsoletes	RHBA-2000:133 RHBA-2000:067

1. Topic:

The MySQL database that shipped with Red Hat Linux 7 and the updates for it
have been reported by the MySQL authors to have security problems.

2. Problem description:

The MySQL database that shipped with Red Hat Linux 7 and the updates for
it have been reported by the MySQL authors to have security problems.

These problems (buffer overflow and information protection issues) have
been fixed in version 3.23.32, which also contains the earlier fixes.

Note that MySQL has updated its client library since the initial version
shipped with Red Hat Linux 7. A new package, mysqlclient9, must be used
for running applications linked with the libmysqlclient.so.9 library.

3. Bug IDs fixed: (see bugzilla for more information)

24381 - Buffer Overflow in MySQL <3.23.31
22649 - encrypt() function not supported
24589 - mysql logrotate script returns an error, log doesn't get rotated

4. Relevant releases/architectures:

Red Hat Linux 7.0 - alpha, i386

5. RPMs required:

6. Solution:

Because of dependencies, the packages must be installed as a group.

After downloading all RPMs needed for your particular architecture, run:

rpm -Uvh mysql*

Note that in rare cases, the shutdown of the old database fails after
upgrade - to ensure a smooth upgrade, shut the database down before
upgrading:

service mysqld stop

7. Verification:

MD5 sum                           Package Name
-------------------------------------------------------------------------
1d13ef56b8898abf8841510db3c0be49  7.0/en/os/SRPMS/mysql-3.23.32-1.7.src.rpm
f538d811ec522c86ab890657e859a4f4  7.0/en/os/SRPMS/mysqlclient9-3.23.22-3.src.rpm
c838e7245d2ca45357e556317873fcca  7.0/en/os/alpha/mysql-3.23.32-1.7.alpha.rpm
5a5049769bd785e800fe629c7875dec8  7.0/en/os/alpha/mysql-devel-3.23.32-1.7.alpha.rpm
5cb73bca58042bb7604361c224878f08  7.0/en/os/alpha/mysql-server-3.23.32-1.7.alpha.rpm
e5f65a87cb3e019456d842d565693476  7.0/en/os/alpha/mysqlclient9-3.23.22-3.alpha.rpm
d8097aa8c188b386803267446286a01a  7.0/en/os/i386/mysql-3.23.32-1.7.i386.rpm
528a72c7b017458f6cad65978b93305e  7.0/en/os/i386/mysql-devel-3.23.32-1.7.i386.rpm
8ec7d8b903e1608de50f49196837e40c  7.0/en/os/i386/mysql-server-3.23.32-1.7.i386.rpm
38a96abb2b68fa9354f715da47767386  7.0/en/os/i386/mysqlclient9-3.23.22-3.i386.rpm

These packages are GPG signed by Red Hat, Inc. for security. Our key is available at:
http://www.redhat.com/about/contact.html

You can verify each package with the following command: rpm --checksig filename

If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg filename

Note that you need RPM >= 3.0 to check GnuPG keys.

8. References:

http://www.mysql.com/documentation/mysql/bychapter/manual_News.html#News-3.23.31