PT-2004-1975 · Mysql Server · Mysql Server

Sergei Golubchik · Published 2004-10-21 · Updated 2019-12-17 · CVE-2004-0957

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: MySQL versions 3.23.58 and earlier

Description: A local user with privileges for a database whose name includes a " " (underscore) can grant privileges to other databases with similar names, allowing unauthorized activities.

Recommendations: For MySQL versions 3.23.58 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0957

DSA-707-1

Affected Products

Mysql Server

References · 9

• https://ubuntu.com/usn/usn-32-1 · Vendor Advisory
• http://debian.org/security/2005/dsa-707 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:070 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-611.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-597.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0957 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000947 · Vendor Advisory
• http://ciac.org/ciac/bulletins/p-018.shtml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17783 · Note