TITLE: MySQL MERGE Table Privilege Revoke Bypass

SECUNIA ADVISORY ID: SA21259

VERIFY ADVISORY: http://secunia.com/advisories/21259/

CRITICAL: Not critical

IMPACT: Security Bypass

WHERE: >From local network

SOFTWARE:
MySQL 5.x - http://secunia.com/product/8355/
MySQL 4.x - http://secunia.com/product/404/
MySQL 3.x - http://secunia.com/product/99/

DESCRIPTION: Peter Gulutzan has reported a vulnerability in MySQL, which can be exploited by malicious users to bypass certain security restrictions.

The vulnerability is caused due to a design error in the user privilege verification for MERGE tables. This can be exploited to keep access to a table via an in advance created MERGE table even after the privileges has been revoked for the table.

SOLUTION:
MySQL 4.1.x: Update to version 4.1.21.
MySQL 5.x: The vulnerability has been fixed in the CVS repository and will also be fixed in the upcoming 5.0.24 version.
Grant only trusted users access to the database.
NOTE: The vulnerability has been fixed by introducing the "--skip-merge" command line option which disables the MERGE storage engine.

PROVIDED AND/OR DISCOVERED BY: Peter Gulutzan

ORIGINAL ADVISORY: MySQL:
http://dev.mysql.com/doc/refman/4.1/en/news-4-1-21.html
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-24.html

pcnuke writes:  

Pc-Nuke! releases new updated version of 'HOT or NOT' module v2.2a
----------------------------------------------------------------------
PCN HOT or NOT v2.2a( view it): The Hot Or Not module enables you to let users/members upload & rate images on your Nuke website. It includes a block that will display a random image, which the user can rate from 1 to 10. The module shows lists of the images using different sorting, where the users can also rate the images. PCN has updated and added to this module allowing the rating system to work up thru Nuke v7.9, we have made the module look and work better, also now you can adjust how many images are shown per page.

See it in Action: Go Now!
Pc-Nuke! WebSite: Go Now!
----------------------------------------------
The Power of the Nuke - Without the Radiation!
The Pc-Nuke! Team!
Stop the Violence!

kguske writes:  

The nukeSEO Mouse Hover Topic BoxOver forums mod enhances search engine optimization while improving forum efficiency. Using the BoxOver popup script and the title tag, this simple mod displays the bbcode-formatted post in a popup on the viewforum page (the last post) and the forum search page (for each result) when hovering over the post.

See it here (viewtopic) and here (forum search). Download it here (free registration required). Read More...

Mars writes:  

PortalThemes - Portal Theme PHPNuke Theme Released
PortalSite is a clean fast loading PHPNuke Theme.

Preview the theme at the PortalThemes PHPNuke Theme test site.
Includes a matching forum theme.
PSD file included for the header.

Be sure to checkout our wide selection of PHP-Nuke Themes
PortalThemes.com

sasavtec writes:  

Hello everyone

Well im here to tell you about my new Arcade www.FlashFunGames.org we currently have over 2200+ Games and more to come including clips, and cartoons. We have over 102263 Game Plays with an average from 500 to 1000+ a day mostly on weekends. So please visit and play some games you can play as many times as you would like you dont have to register.


www.FlashFunGames.org Over 2200 Games For Everyone.

Thanks

White_Devil writes:  

Devil Modz - Sexy or Not Module Version 1.0 Introduction What is all this about you ask? Well quite simply is is a module kind of like Hot or Not for PHP-Nuke. People can upload there pictures add a comment to it and get it rated on a scale of 1-10 by everyone else. I have tried other modules for PHP-Nuke and could never get them to work. Someone finally asked my to try to install one of the others on there site and could not get it to work. So Sexy or Not module was born. I decided instead of messing around with a lot of code that I could not understand, I would make one from scratch. Some of the looks are based off the others since I am not a good designer but all the code is originally mine and from the ground up. There are many features in this module. It even comes with a block. Please forgive me, I am not good at writing these kind of Readme's and what not's. If someone wants to make one better please do and send it my way. arleighesq@gmail.com. Download at http://devil-nuke-mods.be/modules.php?name=Downloads&op=getit&lid=14 Read More...