PT-2005-2613 · Oracle+1 · Mysql Server+1

Josh Bressers · Publicado 2005-05-17 · Atualizado 2019-12-17 · CVE-2005-1636

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions 4.1.x up to 4.1.11 MySQL versions 5.x up to 5.0.4

Description The issue allows local users to execute arbitrary SQL commands by modifying the contents of a file created by mysql install db. This is due to the file being created with a predictable filename and insecure permissions.

Recommendations For MySQL versions 4.1.x up to 4.1.11, update to version 4.1.12 or later. For MySQL versions 5.x up to 5.0.4, update to version 5.0.5 or later.

Correção

Identificadores relacionados

CVE-2005-1636

DSA-783-1

RHSA-2005:685

RHSA-2005_685

Produtos afetados

Mysql Server

Red Hat

Referências · 12

• http://marc.info/?l=full-disclosure&m=111632686805498&w=2 · Nota
• http://zataz.net/adviso/mysql-05172005.txt · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2006:045 · Aviso do Fabricante
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=158688 · Nota
• http://secunia.com/advisories/17080 · Nota
• http://redhat.com/support/errata/RHSA-2005-685.html · Aviso do Fabricante
• http://securityfocus.com/bid/13660 · Nota
• http://secunia.com/advisories/15369 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1636 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2005-685.html · Nota
• https://redhat.com/security/data/cve/CVE-2005-1636.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9504 · Nota