Tag Archives: skysql

Monty Program & SkySQL: a statement on the serious security vulnerability that was found in MariaDB and MySQL

Posted on by

Over the past few days extensive conversations around a new security vulnerability in MariaDB and MySQL have taken place.

It all started as a chain reaction when Monty Program publicly disclosed information about the flaw they had found and about how to make sure your MariaDB and MySQL installations can be fixed. The initial information got assigned the security vulnerabitlity identifier CVE-2012-2122 and the contents can be seen e.g. here http://seclists.org/oss-sec/2012/q2/493.

The bug was found two months ago on April 4th.

Before disclosing the information publicly, given the seriousness of this bug and considering the millions of MySQL and MariaDB installations deployed worldwide, Monty Program informed the biggest distributors of MySQL and MariaDB as a precaution.

On April 6th, Monty Program informed Oracle about it in bug report http://bugs.mysql.com/bug.php?id=64884 and provided a suggested fix.

The other big distributors of MySQL and MariaDB are the major Linux distributions that were alerted also in April and provided with a fix for old (unsupported by Oracle) MySQL versions. This gave Oracle and the Linux distributions some lead time to check if their MySQL and/or MariaDB builds were vulnerable and apply the provided fix if needed.

Whether your MySQL or MariaDB installation is vulnerable depends on where and how the binaries you use were built.

Official binaries of MariaDB, provided by Monty Program, MySQL binaries provided by Oracle and – in the case you use Percona’s provided binaries of their server – have all been tested. All these vendors have confirmed that the vulnerability isn’t present in their binaries and that it actually has never been present due to the way that the binaries are built.

All binaries listed on the SkySQL website are either official Oracle or official MariaDB binaries mirrored from dev.mysql.com/downloads and downloads.mariadb.org.

If you built your binaries yourself, you (or your database administrator) can easily test if your installation is vulnerable or not by following the instructions found e.g. here http://ronaldbradford.com/blog/repost-a-tragically-comedic-security-flaw-in-mysql-2012-06-11/.

In the case that you build or have built your own binaries another good piece of information is that the fix (getting rid of the problem independently of how you build) was first released in MariaDB in version 5.5.23 on April 10. Oracle followed by having the fix in MySQL 5.5.24 on May 7.

Most of us, MariaDB and MySQL users, do not have a need to build binaries on our own, i.e. we are on a platform that the official MariaDB and MySQL binaries are provided for and we do not have our own patches that would need to be applied before producing our own binaries.

For most of us it’s therefore recommended to get the binaries from the official channels, such as through the Linux distribution you use via the distribution’s repository or through the official download channel of the database, which in the case of MariaDB is http://downloads.mariadb.org.

Also, if you want to make sure that you’re on the latest version of MariaDB and you’re running on CentOS, Fedora, Debian, Red Hat or Ubuntu you should consider adding MariaDB’s official repository, http://downloads.mariadb.org/mariadb/repositories/.

MariaDB and/or MySQL packagers (such as Linux distributions) should make sure they sign up for the MariaDB mailing list intended for packagers at https://lists.askmonty.org/cgi-bin/mailman/listinfo/packagers to receive important notifications including early disclosure of security vulnerabilities, like this one.

SkySQL Roadshows – Seoul & Tokyo

Posted on by

A lot is happening in the world of MySQL lately. If you’re in Asia, SkySQL has been organising roadshows. On May 18, there was a captive audience in Singapore, listening to David Axmark (advisor to SkySQL, co-founder of MySQL Ab), Daniel Saito (SkySQL), and Colin Charles (Monty Program). On May 20, there was a huge audience in Manila, and I was totally bummed to have missed out on it.

I’m told there’s going to be an awesome audience tomorrow, May 27, in Seoul, South Korea. Lotte Hotel will be abuzz with all things SkySQL, Monty Program, and MariaDB, and it will feature Kaj Arno and Daniel Saito from SkySQL, and Colin Charles from Monty Program.

May 30 brings upon the SkySQL Roadshow in Tokyo, hosted at the Yurakucho International Forum.

If you plan to attend any of these events (Daniel tells me they’re also reaching capacity) and are in the area, don’t hesitate to drop daniel[at]skysql[dot]com an email and I’m sure he’ll furnish you with the relevant information.

SkySQL Ab first to pass the Platinum Support Partner criteria for Monty Program

Posted on by

Santa Clara, CA, USA — Wednesday, April 13, 2011 — Monty Program Ab today announced that SkySQL Ab is the first partner to achieve Platinum Support Partner status with Monty Program. The criteria include offering 24 x 7 support worldwide, a proven ability to handle first and second level support cases for MySQL® and MariaDB®, as well as having delivered a certain amount of well-defined commercial 3rd level support cases in the form of bug fix requests to Monty Program Ab.

“We’re happy to work with the SkySQL support team” says Rasmus Johansson, COO of Monty Program Ab. “The requests for bug fixes we get cover both MySQL and MariaDB, and they’re well researched, enabling us to deliver solutions quickly,” Johansson continued.

“Working with the Monty Program Ab team feels very natural for us, and enables us to provide a high level of service for our customers” confirms Dean Ellis, SkySQL Ab Director of Support. “This is no surprise to us, of course. We use the same methods, tools, and working relationships that had been in place for years when we were colleagues at MySQL AB.” Ellis highlights the Eventum system for support tickets, which both companies use and have interfaced.

“SkySQL’s capable Support Team, both expert and new users can get the best level of MySQL and MariaDB support in the industry. And should a support case involve bug fixing, we are there to correct the problem,” said Michael “Monty” Widenius, CEO of Monty Program Ab. Widenius also stressed that “the commercial agreement with SkySQL enables us to develop MariaDB further.”

Via the press release.