PT-2004-1897 · Oracle · Mysql Server

Oleksandr Byelkin · Published 2004-10-16 · Updated 2019-10-07 · CVE-2004-0835

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: MySQL versions 3.x through 3.23.58 MySQL versions 4.x through 4.0.18 MySQL versions 4.1.x through 4.1.1 MySQL versions 5.x through 5.0.0

Description: The issue allows attackers to conduct unauthorized activities by checking the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation.

Recommendations: For MySQL versions 3.x through 3.23.58, update to version 3.23.59 or later. For MySQL versions 4.x through 4.0.18, update to version 4.0.19 or later. For MySQL versions 4.1.x through 4.1.1, update to version 4.1.2 or later. For MySQL versions 5.x through 5.0.0, update to version 5.0.1 or later.

Exploit

Fix

Related Identifiers

CVE-2004-0835

DSA-562-2

Affected Products

Mysql Server

References · 18

• 🔥 http://securityfocus.com/bid/11357 · Exploit
• 🔥 http://bugs.mysql.com/bug.php?id=3270 · Exploit
• 🔥 https://exploit-db.com/exploits/24669 · Exploit
• http://secunia.com/advisories/12783 · Vendor Advisory
• http://mysql.org/doc/refman/4.1/en/news-4-0-19.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0835 · Security Note
• http://mysql.org/doc/refman/4.1/en/news-4-1-2.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-611.html · Vendor Advisory
• http://lists.mysql.com/internals/13073 · Vendor Advisory
• http://trustix.org/errata/2004/0054 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101864-1 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200410-22.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-597.html · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000892 · Vendor Advisory
• http://securitytracker.com/id?1011606 · Note