[CentOS] C5 MySQL injection attack ("Union Select")

Thu Mar 24 15:59:45 UTC 2016
Johnny Hughes <johnny at centos.org>

On 03/24/2016 10:48 AM, Johnny Hughes wrote:
> On 03/24/2016 03:54 AM, Leon Fauster wrote:
>> Am 24.03.2016 um 04:21 schrieb Always Learning <centos at u64.u22.net>:
>>> mysql  Ver 14.12 Distrib 5.0.95, for redhat-linux-gnu (x86_64) using
>>> readline 5.1
>>
>>
>>
>> Current version on C5 is mysql55, 5.0 does not get any updates anymore!
>>
> 
> Let me reiterate this:
> 
> the mysql-5.0.95* packages are not supported.  A very long time ago, Red
> Hat upgraded mysql for el5 to an SCL.  The current supported version is:
> 
> 
> mysql55-mysql-5.5.45-1.el5*
> 
> I guarantee that the 5.0.95 packages have security issues. Here is how
> to move to the newer mysql55 packages:
> 
> http://red.ht/1pAcb7q
> 
> I can't stress enough, mysql-5.0 on el5 is absolutely not updated
> security wise.  The last update to it happened on 22-Jan-2013 and was in
> CentOS-5.9 .. we are now in 5.11 and there have been upgrades to mysql55
> since then to fix security issues.
> 
> Here is more info on this MySQL 5.0 to 5.5 upgrade, that was required
> starting in CentOS 5.10.
> 
> http://red.ht/1o8VkHN
> 
> http://red.ht/1UK30hR
> 
> http://red.ht/1q48NT5

This shoule not be news to anyone .. it was in the CentOS-5.10 release
notes:

https://wiki.centos.org/Manuals/ReleaseNotes/CentOS5.10

(first two bullets in 'New Features' section)

There were also discussions on this list:

https://lists.centos.org/pipermail/centos/2013-October/137939.html

Thanks,
Johnny Hughes







-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <http://lists.centos.org/pipermail/centos/attachments/20160324/de0aa09a/attachment-0004.sig>