PT-2012-6060 · Mariadb Foundation+2 · Mariadb+2

Huzaifa Sidhpurwala · Publicado 2012-12-03 · Atualizado 2024-08-06 · CVE-2012-5613

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions 5.5.19 and possibly other versions MariaDB versions 5.5.28a and possibly other versions

Description The issue allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator, when configured to assign the FILE privilege to users who should not have administrative privileges. The vendor disputes this issue, stating that it is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation.

Recommendations For MySQL version 5.5.19, consider restricting the FILE privilege to only administrative users. For MariaDB version 5.5.28a, consider restricting the FILE privilege to only administrative users. As a temporary workaround, consider disabling the assignment of the FILE privilege to non-administrative users until a proper configuration is in place. Restrict access to sensitive files and directories to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2012-5613

Produtos afetados

Mariadb

Mysql Server

Suse

Referências · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/mysql/mysql_mof.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/mysql/mysql_start_up.rb · Exploit
• 🔥 https://github.com/Hood3dRob1n/MySQL-Fu.rb · Exploit
• 🔥 https://exploit-db.com/exploits/23179 · Exploit
• 🔥 https://exploit-db.com/exploits/23077 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2012/Dec/6 · Exploit
• 🔥 https://exploit-db.com/exploits/35777 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201308-06.xml · Aviso do Fabricante
• https://t.me/cvenotify/89529 · Publicação no Telegram
• http://secunia.com/advisories/53372 · Nota
• https://t.me/cvenotify/80283 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2012/12/02/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5613 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/12/02/4 · Nota