PT-2005-2613 · Oracle+1 · Mysql Server+1

Josh Bressers · Published 2005-05-17 · Updated 2019-12-17 · CVE-2005-1636

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions 4.1.x up to 4.1.11 MySQL versions 5.x up to 5.0.4

Description The issue allows local users to execute arbitrary SQL commands by modifying the contents of a file created by mysql install db. This is due to the file being created with a predictable filename and insecure permissions.

Recommendations For MySQL versions 4.1.x up to 4.1.11, update to version 4.1.12 or later. For MySQL versions 5.x up to 5.0.4, update to version 5.0.5 or later.

Fix

Related Identifiers

CVE-2005-1636

DSA-783-1

RHSA-2005:685

RHSA-2005_685

Affected Products

Mysql Server

Red Hat

References · 12

• http://mandriva.com/security/advisories?name=MDKSA-2006:045 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-685.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1636 · Security Note
• http://marc.info/?l=full-disclosure&m=111632686805498&w=2 · Note
• http://zataz.net/adviso/mysql-05172005.txt · Note
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=158688 · Note
• http://secunia.com/advisories/17080 · Note
• http://securityfocus.com/bid/13660 · Note
• http://secunia.com/advisories/15369 · Note
• https://rhn.redhat.com/errata/RHSA-2005-685.html · Note
• https://redhat.com/security/data/cve/CVE-2005-1636.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9504 · Note