**USN-274-2: MySQL vulnerability**  
  
A new MySQL vulnerability update is available for Ubuntu Linux. Here the announcement:  
  


Ubuntu Security Notice USN-274-2 May 15, 2006  
mysql-dfsg vulnerability  
CVE-2006-0903  
  
A security issue affects the following Ubuntu releases:  
  
Ubuntu 5.04 (Hoary Hedgehog)  
Ubuntu 5.10 (Breezy Badger)  
  
The following packages are affected:  
  
mysql-server  
  
The problem can be corrected by upgrading the affected package to  
version 4.0.23-3ubuntu2.4 (for Ubuntu 5.04), or 4.0.24-10ubuntu2.3  
(for Ubuntu 5.10). In general, a standard system upgrade is  
sufficient to effect the necessary changes.  
  
Details follow:  
  
USN-274-1 fixed a logging bypass in the MySQL server. Unfortunately it  
was determined that the original update was not sufficient to  
completely fix the vulnerability, thus another update is necessary. We  
apologize for the inconvenience.  
  
For reference, these are the details of the original USN:  
  
A logging bypass was discovered in the MySQL query parser. A local  
attacker could exploit this by inserting NUL characters into query  
strings (even into comments), which would cause the query to be  
logged incompletely.  
  
This only affects you if you enabled the 'log' parameter in the  
MySQL configuration.  
  
Updated packages for Ubuntu 5.04:  
  
Source archives:  
  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.23-3ubuntu2.4.diff.gz  
Size/MD5: 347218 5bf62963f2439449d17429b974dc954e  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.23-3ubuntu2.4.dsc  
Size/MD5: 891 cf807937ea7cb09d1717c562c355e2cd  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.23.orig.tar.gz  
Size/MD5: 9814467 5eec8f66ed48c6ff92e73161651a492b  
  
Architecture independent packages:  
  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-common_4.0.23-3ubuntu2.4_all.deb  
Size/MD5: 32366 1a3bd9d864cae3bfa1987f859b5624aa  
  
amd64 architecture (Athlon64, Opteron, EM64T Xeon)  
  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.23-3ubuntu2.4_amd64.deb  
Size/MD5: 2867226 cee7c90e2a0fd2ab3d17ba1b25b74f0d  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12_4.0.23-3ubuntu2.4_amd64.deb  
Size/MD5: 307670 e7fea674e9dcad07d491e70f80aefa77  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-client_4.0.23-3ubuntu2.4_amd64.deb  
Size/MD5: 431800 6b87ceedfa25337da77b1cb0f461526e  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-server_4.0.23-3ubuntu2.4_amd64.deb  
Size/MD5: 3629366 3ae34465083080e3bf9d620f8cb8cb02  
  
i386 architecture (x86 compatible Intel/AMD)  
  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.23-3ubuntu2.4_i386.deb  
Size/MD5: 2827210 8efa7c02567c9728cd915d3c40e5a197  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12_4.0.23-3ubuntu2.4_i386.deb  
Size/MD5: 290266 d922e809d77b6b5dc3b4ed0b60aab4ca  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-client_4.0.23-3ubuntu2.4_i386.deb  
Size/MD5: 405024 b44e2e31c97d7e53fe0c165c8857dae2  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-server_4.0.23-3ubuntu2.4_i386.deb  
Size/MD5: 3538020 3b77c2725479cf9167f0015ab6c84217  
  
powerpc architecture (Apple Macintosh G3/G4/G5)  
  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.23-3ubuntu2.4_powerpc.deb  
Size/MD5: 3181320 b9a3a84b59e90cebc93f0a19cc63c9ef  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12_4.0.23-3ubuntu2.4_powerpc.deb  
Size/MD5: 313258 cbcdd0d05906c05ff730b1b75d04c860  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-client_4.0.23-3ubuntu2.4_powerpc.deb  
Size/MD5: 462556 3b7b56ceb6c3698ab404080a0692f5ec  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-server_4.0.23-3ubuntu2.4_powerpc.deb  
Size/MD5: 3840116 63049c52217853f785162ba6d54f133d  
  
Updated packages for Ubuntu 5.10:  
  
Source archives:  
  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.24-10ubuntu2.3.diff.gz  
Size/MD5: 99812 d274d44f9970d8b2489f2a70b033f77a  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.24-10ubuntu2.3.dsc  
Size/MD5: 966 2f2a9b55283f1d634dce18e558d92ba3  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.24.orig.tar.gz  
Size/MD5: 9923794 aed8f335795a359f32492159e3edfaa3  
  
Architecture independent packages:  
  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-common_4.0.24-10ubuntu2.3_all.deb  
Size/MD5: 35028 a2a4b01f8de78f0489b2fb1563cb5f7a  
  
amd64 architecture (Athlon64, Opteron, EM64T Xeon)  
  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10ubuntu2.3_amd64.deb  
Size/MD5: 3232638 40620811f457a1bc647683d69dabed50  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10ubuntu2.3_amd64.deb  
Size/MD5: 308672 f67209b5f82fe1db0a8aaf2089775249  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-client_4.0.24-10ubuntu2.3_amd64.deb  
Size/MD5: 439872 29286727ed489fca96b7357b31654472  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-server_4.0.24-10ubuntu2.3_amd64.deb  
Size/MD5: 3922314 78937781a11bf5746e8bf097f2779d2e  
  
i386 architecture (x86 compatible Intel/AMD)  
  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10ubuntu2.3_i386.deb  
Size/MD5: 2869396 6e99c974cb0355a5e38d3ad5ac5efc07  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10ubuntu2.3_i386.deb  
Size/MD5: 292406 09616be33817ad7f18b9cf51fe113ff4  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-client_4.0.24-10ubuntu2.3_i386.deb  
Size/MD5: 413836 6e183f2233ce7ce06debad5c859ba0f5  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-server_4.0.24-10ubuntu2.3_i386.deb  
Size/MD5: 3556146 b3baed5ddbe9fb739dd99b7849016e5e  
  
powerpc architecture (Apple Macintosh G3/G4/G5)  
  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12-dev_4.0.24-10ubuntu2.3_powerpc.deb  
Size/MD5: 3091448 0396a05bb982ca252035a11c2c05bae7  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/libmysqlclient12_4.0.24-10ubuntu2.3_powerpc.deb  
Size/MD5: 306534 0acfdb89ce0e89142f97ccf9a35ed37a  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-client_4.0.24-10ubuntu2.3_powerpc.deb  
Size/MD5: 453810 d5e519305ce715c0092e943331d0e6ce  
http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/mysql-server_4.0.24-10ubuntu2.3_powerpc.deb  
Size/MD5: 3665140 272c761ae9f0c232444c7701a65a98c9  
  
\--EVcIhgQsEzAXu06J  
Content-Type: application/pgp-signature; name="signature.asc"  
Content-Description: Digital signature  
Content-Disposition: inline  
  
\-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.2.2 (GNU/Linux)  
  
iD8DBQFEaJJiDecnbV4Fd/IRAvagAKDvDPrPczvvAApw++fLoXZcr1p6qACeJNe3  
lLt2GTxkxPlo9Jm9bnTPgOA=  
=/Mai  
\-----END PGP SIGNATURE-----