USN-303-1: MySQL vulnerability

Releases

• Ubuntu 6.06
• Ubuntu 5.10

Details

An SQL injection vulnerability has been discovered when using less
popular multibyte encodings (such as SJIS, or BIG5) which contain
valid multibyte characters that end with the byte 0x5c (the
representation of the backslash character >>\<< in ASCII).

Many client libraries and applications use the non-standard, but
popular way of escaping the >>'<< character by replacing all
occurences of it with >>\'<<. If a client application uses one of the
affected encodings and does not interpret multibyte characters, and an
attacker supplies a specially crafted byte sequence as an input string
parameter, this escaping method would then produce a validly-encoded
character and an excess >>'<< character which would end the string.
All subsequent characters would then be interpreted as SQL code, so
the attacker could execute arbitrary SQL commands.

The updated packages fix the mysql_real_escape_string() function to
escape quote characters in a safe way. If you use third-party software
which uses an ad-hoc method of string escaping, you should convert
them to use mysql_real_escape_string() instead, or at least use the
standard SQL method of escaping >>'<< with >>''<<.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 6.06

• libmysqlclient15off - 5.0.22-0ubuntu6.06
• mysql-server-5.0 - 5.0.22-0ubuntu6.06

Ubuntu 5.10

• mysql-server-4.1 - 4.1.12-1ubuntu3.5
• libmysqlclient14 - 4.1.12-1ubuntu3.5

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2006-2753

Related notices

• USN-288-3: exim4-daemon-heavy, postfix-pgsql, dovecot-common