{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MySQL 3.x ;",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    },
    {
      "description": "MySQL 4.x.",
      "product": {
        "name": "MySQL",
        "vendor": {
          "name": "Oracle",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\n-   Une vuln\u00e9rabilit\u00e9 dans les requ\u00eates SQL (Standard Query Language) de\n    type \u00ab ALTER TABLE ... RENAME \u00bb permet \u00e0 un utilisateur mal\n    intentionn\u00e9 d\u0027\u00e9lever ses privil\u00e8ges et d\u0027acc\u00e8der \u00e0 des informations\n    confidentielles.\n-   Une seconde vuln\u00e9rabilit\u00e9 permet \u00e0 un utilisateur mal intentionn\u00e9 de\n    r\u00e9aliser un d\u00e9ni de service, via l\u0027envoi de plusieurs requ\u00eates SQL\n    de type \u00ab ALTER \u00bb.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).  \nLes versions 3.23.59 et 4.0.21 corrigent ces vuln\u00e9rabilit\u00e9s.\n",
  "cves": [],
  "initial_release_date": "2004-10-15T00:00:00",
  "last_revision_date": "2004-12-20T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de Mysql n\u00b02408 :",
      "url": "http://bugs.mysql.com/bug.php?id=2408"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2004:569 du 20 octobre    2004 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2004-569.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200410-22 du 24 octobre    2004 :",
      "url": "http://www.gentoo.org/security/en/GLSA/GLSA-200410-22.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2004:597 du 20 octobre    2004 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2004-597.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2004:611 du 27 octobre    2004 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2004-611.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-562 du 11 octobre 2004 :",
      "url": "http://www.debian.org/security/2004/dsa-562"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 FreeBSD du 16 d\u00e9cembre 2004 :",
      "url": "http://www.vuxml.org/freebsd/"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SR:2004:001 du 24 novembre    2004 :",
      "url": "http://www.suse.de/de/security/2004_01_sr.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandrake MDKSA-2004:119 du 01 novembre    2004 :",
      "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:119"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de Mysql n\u00b03270 :",
      "url": "http://bugs.mysql.com/bug.php?id=3270"
    },
    {
      "title": "Site internet de Mysql :",
      "url": "http://www.mysql.com"
    }
  ],
  "reference": "CERTA-2004-AVI-347",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-10-15T00:00:00.000000"
    },
    {
      "description": "ajout du bulletin de s\u00e9curit\u00e9 redhat.",
      "revision_date": "2004-10-22T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Mandrake et Gentoo.",
      "revision_date": "2004-11-05T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 SUSE, Debian, RedHat et ajout de la r\u00e9f\u00e9rence CVE CAN-2004-0836.",
      "revision_date": "2004-11-25T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence aux bulletins de s\u00e9curit\u00e9 FreeBSD du 16 d\u00e9cembre 2004.",
      "revision_date": "2004-12-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s pr\u00e9sentes sur le gestionnaire de base de donn\u00e9es\nMySQL permettent \u00e0 un utilisateur mal intention\u00e9 de r\u00e9aliser un d\u00e9ni de\nservice ou d\u0027\u00e9lever ses privil\u00e8ges sur le gestionnaire de base de\ndonn\u00e9es vuln\u00e9rable.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans MySQL",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 Mysql",
      "url": null
    }
  ]
}