PT-2007-4008 · Oracle+1 · Mysql Server+1

Victoria Reznichenko · Publicado 2007-05-16 · Atualizado 2018-10-19 · CVE-2007-2691

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions prior to 4.1.23 MySQL versions 5.0.x prior to 5.0.42 MySQL versions 5.1.x prior to 5.1.18

Description The issue allows remote authenticated users to rename arbitrary tables due to the lack of a requirement for the DROP privilege for RENAME TABLE statements.

Recommendations For MySQL versions prior to 4.1.23, update to version 4.1.23 or later. For MySQL versions 5.0.x prior to 5.0.42, update to version 5.0.42 or later. For MySQL versions 5.1.x prior to 5.1.18, update to version 5.1.18 or later.

Correção

Identificadores relacionados

CVE-2007-2691

DSA-1413-1

RHSA-2007:0894

RHSA-2008:0364

RHSA-2008:0768

RHSA-2008_0364

RHSA-2008_0768

Produtos afetados

Mysql Server

Red Hat

Referências · 53

• https://access.redhat.com/security/cve/CVE-2007-2583 · Nota
• http://secunia.com/advisories/27155 · Nota
• http://securityfocus.com/bid/19559 · Nota
• http://secunia.com/advisories/31226 · Nota
• http://lists.mysql.com/announce/470 · Aviso do Fabricante
• https://issues.rpath.com/browse/RPL-1536 · Nota
• http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html · Aviso do Fabricante
• http://osvdb.org/34766 · Nota
• http://secunia.com/advisories/28838 · Nota
• https://access.redhat.com/security/cve/CVE-2008-2079 · Nota
• https://access.redhat.com/security/cve/CVE-2006-0903 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2007:139 · Aviso do Fabricante
• http://securitytracker.com/id?1018069 · Nota
• https://access.redhat.com/errata/RHSA-2008:0364 · Nota
• https://usn.ubuntu.com/528-1 · Aviso do Fabricante