Gentoo: mysql remote root exploit
MySQL will no longer read config files that are world-writeable.
Summary
- - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200303-14 - - ---------------------------------------------------------------------
- - ---------------------------------------------------------------------
"This issue has been adressed in 3.23.56 (release build is started today), and some steps were taken to alleviate the threat.
In particular, MySQL will no longer read config files that are world-writeable (and SELECT ... OUTFILE always creates world-writeable files). Also, unlike other options, for --user option the first one will have the precedence. So if --user is set in /etc/my.cnf (as it is recommended in the manual), datadir/my.cnf will not be able to override it."
quote from: http://marc.theaimsgroup.com/?l=bugtraq&m=104739810523433&w=2
SOLUTION
It is recommended that all Gentoo Linux users who are running dev-db/mysql upgrade to mysql-3.23.56 as follows:
emerge sync emerge mysql emerge clean
- - --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at - - ---------------------------------------------------------------------
3.23.56
Resolution
References
Availability
Concerns
Severity
PACKAGE : mysql
SUMMARY : remote root exploit
DATE : 2003-03-18 18:12 UTC
EXPLOIT : remote
VERSIONS AFFECTED : <3.23.56 : fixed version>=3.23.56
CVE :
