PT-2008-5401 · Oracle+1 · Mysql Server+1

Devin Carraway · Publicado 2008-09-17 · Atualizado 2019-12-17 · CVE-2008-4098

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions prior to 5.0.67

Description The issue allows local users to bypass certain privilege checks by exploiting the CREATE TABLE functionality on MyISAM tables. This is achieved by modifying the DATA DIRECTORY or INDEX DIRECTORY arguments to point to tables that can be created at a future time, potentially allowing access to subdirectories of the MySQL home data directory through symlinks.

Recommendations For MySQL versions prior to 5.0.67, update to version 5.0.67 or later to resolve the issue.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2008-4098

DSA-1662-1

RHSA-2009:1067

RHSA-2010:0110

RHSA-2010_0110

Produtos afetados

Mysql Server

Red Hat

Referências · 27

• http://secunia.com/advisories/32578 · Nota
• https://access.redhat.com/errata/RHSA-2010:0110 · Nota
• http://openwall.com/lists/oss-security/2008/09/09/20 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0058.html · Nota
• http://secunia.com/advisories/32759 · Nota
• http://ubuntu.com/usn/USN-1397-1 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45649 · Nota
• http://redhat.com/support/errata/RHSA-2010-0110.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2009-1067.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2008-4098 · Nota
• http://secunia.com/advisories/38517 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html · Aviso do Fabricante
• http://secunia.com/advisories/32769 · Nota
• https://access.redhat.com/security/cve/CVE-2009-2446 · Nota
• http://openwall.com/lists/oss-security/2008/09/16/3 · Nota