Critical MySQL Flaw Found

[Fire0ne]

http://news.yahoo.com/news?tmpl=story&u=/zd/20050722/tc_zd/156580

If you have a site hosted and use that for your site find out from your hosting company if they updated or not.

Just thought i would share that news article.

[ic]

Fire0ne, welcome to MyADSL, and thanks for the heads up :).
...
The vulnerability lies in the fact that MySQL uses a vulnerable zlib library. Zlib is a data compression library used to support the compressed protocol and the COMPRESS/UNCOMPRESS functions under Windows.

The error occurs in "inftrees.c" when handling corrupted compressed data streams.

According to Secunia's alert, the flaw can be exploited to crash any application that uses the zlib library. Alternatively, malicious users can execute arbitrary code with privileges of the vulnerable application.

While the flaw was reported in Version 1.2.2, earlier versions may also be at risk.

The flaw was originally reported by MySQL, along with the fix. It was discovered by Tavis Ormandy of the Gentoo
Linux Security Audit Team.

The solution is to update to MySQL Version 4.1.13. According to a spokesperson for MySQL, the flaw has not been exploited, to the knowledge of MySQL.
... (http://news.yahoo.com/news?tmpl=story&u=/zd/20050722/tc_zd/156580)

[Mean_Monster]

Another new member with value to add. Cool

[Fire0ne]

Thanks for the welcome. :) I have been reading the myadsl forum for a while now. Decided to join to post that article.

[louisp]

Glad you joined!!

Don't use MySQL but the info seems very handy as we are about to move a large databse from DB2 to SQL.

:)

[Mean_Monster]

yeah seems most people only register once they want to say something. :p

[Karnaugh]

thats why we use Postgresql!

[Page]

using MySQL extensively @ work. Was looking for a good reason to move to MySQL5, the boss wouldn't budge. Thx for the ammo FireOne *g*

[Raithlin]

Thx FireOne. I would assume that if one is not using the zlib library, that one would not be in harm's way?