Security bugs are reported here via bugzilla

[Seth Woolley <seth AT tautology.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Why oh why.  Some things to mitigate mysql breakings:

in your /etc/my.cnf if you are only doing local connections:

[mysqld]
skip-networking

we already run under mysql user with our init script as well.

I considered making a locked down /etc/my.cnf file by default that turned
off networking by default.  Anybody opposed?

Is perforce coming back any time soon?  I usually have these patched and
announced within a few hours of hearing, but I'm powerless now.  Might
want to make a security announcement relating the pine and mysql exploits
with a "will update when p4 comes back up" note.  Tony, can we elevate
priority somehow?

Seth

P.S.  rarely will anybody get global admin privs for mysql and not be an
admin on the box, so this exploit is mostly theoretical if I understand
correctly, but we should update through to stable anyways.

On Fri, 12 Sep 2003, Ladislav Hagara wrote:

> http://www.securityfocus.com/archive/1/337012/2003-09-08/2003-09-14/0
> mysql spell needs to be updated to 4.0.15
> p4 is still down :-((
>
> - lace -
>
> _______________________________________________
> SM-Security mailing list
> SM-Security AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-security
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)

iD8DBQE/YhVY7fQ833vqzH0RAvAPAJ4vq07Obd2/DgJw92g3f/Uj/Iq6vwCfc7wF
u5WpszRV46XP1rS/ozVtzfA=
=G5k2
-----END PGP SIGNATURE-----