------------------------------------------------------------------------
Pardus Linux Security Advisory 2010-29            security@pardus.org.tr
------------------------------------------------------------------------
      Date: 2010-02-09
  Severity: 3
      Type: Local
------------------------------------------------------------------------

Summary
=======

A security issue has been fixed in MySQL, which  can  be  exploited  by 
malicious, local users to bypass certain security restrictions. 


Description
===========

sql/sql_table.cc in MySQL, when the  data  home  directory  contains  a 
symlink to a different filesystem, allows remote authenticated users to 
bypass intended access restrictions by calling CREATE TABLE with a  (1) 
DATA  DIRECTORY or  (2)  INDEX  DIRECTORY  argument  referring  to   a  
subdirectory that requires following this symlink. 


Affected packages:

  Pardus 2009:
    mysql-server, all before 5.1.41-46-9


Resolution
==========

There are update(s) for mysql-server. You can update them  via  Package 
Manager or with a single command from console: 

    pisi up mysql-server

References
==========

  * http://bugs.pardus.org.tr/show_bug.cgi?id=12211
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7247