A “highly critical” flaw has been reported in MySQL that can be exploited to cause a DoS (Denial of Service) or to execute arbitrary code on the open-source database, according to security alerts aggregator Secunia Inc.
The vulnerability lies in the fact that MySQL uses a vulnerable zlib library. Zlib is a data compression library used to support the compressed protocol and the COMPRESS/UNCOMPRESS functions under Windows.
The error occurs in “inftrees.c” when handling corrupted compressed data streams.
According to Secunias alert, the flaw can be exploited to crash any application that uses the zlib library. Alternatively, malicious users can execute arbitrary code with privileges of the vulnerable application.
While the flaw was reported in Version 1.2.2, earlier versions may also be at risk.
The flaw was originally reported by MySQL, along with the fix. It was discovered by Tavis Ormandy of the Gentoo Linux Security Audit Team.
The solution is to update to MySQL Version 4.1.13. According to a spokesperson for MySQL, the flaw has not been exploited, to the knowledge of MySQL.
To be on the safe side, MySQL recommends people should always upgrade and apply patches as good practice.
Check out eWEEK.coms for the latest database news, reviews and analysis.