PT-2012-5408 · Oracle+1 · Mysql Server+1

Karel Volný + 1 · Publicado 2012-10-09 · Atualizado 2023-02-13 · CVE-2012-4452

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MySQL versions 5.0.88 and possibly other versions

Description The issue allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified DATA DIRECTORY or INDEX DIRECTORY arguments. These arguments can point to tables created at a future time, allowing a pathname to be modified to contain a symlink to a subdirectory of the MySQL data home directory. This is related to incorrect calculation of the mysql unpacked real data home value.

Recommendations For MySQL version 5.0.88, consider restricting the use of the CREATE TABLE statement with modified DATA DIRECTORY or INDEX DIRECTORY arguments until a patch is available. For other possibly affected versions, at the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-4452

RHSA-2013:0121

RHSA-2013_0121

Produtos afetados

Mysql Server

Red Hat

Referências · 7

• https://access.redhat.com/errata/RHSA-2013:0121 · Nota
• https://access.redhat.com/security/cve/CVE-2012-4452 · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0121.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-4452 · Nota de Segurança
• http://securityfocus.com/bid/55715 · Nota
• http://openwall.com/lists/oss-security/2012/09/27/1 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=860808 · Nota