-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2013.0046
                     Multiple vulnerabilities in yaSSL
                               22 March 2013

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              MySQL
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact/Access:        Access Confidential Data -- Remote/Unauthenticated
Resolution:           Patch/Upgrade
CVE Names:            CVE-2013-1623 CVE-2012-4929 
Member content until: Sunday, April 21 2013
Reference:            ESB-2013.0383
                      ESB-2013.0316
                      ESB-2013.0217
                      ESB-2013.0216
                      ESB-2012.1126

OVERVIEW

        Multiple vulnerabilities have been identified in MySQL v5.1.68, 5.5.30
        and 5.6.11 and earlier. [1]


IMPACT

        The vendor has stated that this update fixes the following 
        vulnerabilities: 
        
        "CVE-2013-1623 Vulnerability allows statistical analysis of timing data 
        of crafted packets
        
        CVE-2012-4929 Cryptographic vulnerabiility" [1]


MITIGATION

        The vendor recommends updating to the latest version of MySQL to 
        correct these issues. [1]


REFERENCES

        [1] Multiple vulnerabilities in yaSSL
            https://blogs.oracle.com/sunsecurity/entry/cve_2013_1492_buffer_overflow

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUUu/xO4yVqjM2NGpAQKpDxAAhN1SGiDp8pIAzfAxScxBAVIU1XTs6vNK
9f9Ja53iVIqq5e4WExqPAIc9JQ982U6suifjW3sTqPYXfeSmf0QUwd3kOivQ0t5J
+yUIZKFu+SP/exRv73iYw62xQEi1EG4DDP2/uPxqB6krJjhdkvXfcveE8YhydBG8
XU10xDYfbNzqzngH4aN+U3ZZBDYOabt+oGtkuHF21YfVbLHrOyAx8la5IKBKfJUe
wjpgbcCFfepBWpFlocf0X3ndw4Be33vwJotkIYTqSZhCgUBCE/XMQD3r18Y5RcpP
DGH1c17ax3YjY5KUNIVsWhj3O68ZfvuAWL/bQLePftKG1hWwq1IfsQHP9Uz8mQw8
2j9GQpwx71SmDRpmVH8Se1ABHLBxpctJF6J8dNt58BISf4KoPOn/W3UkCi719xTy
XC/p7oNGoUVWbII9OEXsKB2Rt0/FcZY8gXfULVRS/zW+glG2UhagAvVwFY6MgbJK
ug/gyRdedAPBK+JYFFDrpr2YtHWdVbb1HMShiOTgGqoTyDzwHX35f87GR7XulZda
7yzomvZlDx4fMsG/nxTUMMu6U71ocOLo7+KsHMoQHhrYHTMfdum0jcfcEUNEet10
Ovj1H5fLHZ1Z1q90lplAXCiIU6TJRU5KpmQcPKjdeKWoDdQg81Hhf1YdbXnzXsnm
9OOH5cPusl8=
=Sc0v
-----END PGP SIGNATURE-----