PT-2010-3628 · Oracle · Mysql Server

Shane Bester

·

Publicado

2010-07-13

·

Atualizado

2020-11-09

·

CVE-2010-2008

CVSS v2.0

3.5

Baixa

VetorAV:N/AC:M/Au:S/C:N/I:N/A:P
Name of the Vulnerable Software and Affected Versions MySQL versions prior to 5.1.48
Description The issue allows remote authenticated users with alter database privileges to cause a denial of service, resulting in a server crash and potential database loss. This is achieved through an ALTER DATABASE command that includes a specific string, such as #mysql50# followed by a sequence like ., .., or ../, and an UPGRADE DATA DIRECTORY NAME command. This sequence of commands causes MySQL to move certain directories to the server data directory, leading to the denial of service.
Recommendations For versions prior to 5.1.48, update to version 5.1.48 or later to resolve the issue. As a temporary workaround, consider restricting alter database privileges to minimize the risk of exploitation. Avoid using the ALTER DATABASE command with the specified string sequences until the issue is resolved.

Exploit

Correção

Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2010-2008

Produtos afetados

Mysql Server