PT-2008-5401 · Oracle+1 · Mysql Server+1

Devin Carraway · Published 2008-09-17 · Updated 2019-12-17 · CVE-2008-4098

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions prior to 5.0.67

Description The issue allows local users to bypass certain privilege checks by exploiting the CREATE TABLE functionality on MyISAM tables. This is achieved by modifying the DATA DIRECTORY or INDEX DIRECTORY arguments to point to tables that can be created at a future time, potentially allowing access to subdirectories of the MySQL home data directory through symlinks.

Recommendations For MySQL versions prior to 5.0.67, update to version 5.0.67 or later to resolve the issue.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2008-4098

DSA-1662-1

RHSA-2009:1067

RHSA-2010:0110

RHSA-2010_0110

Affected Products

Mysql Server

Red Hat

References · 27

• http://ubuntu.com/usn/USN-1397-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0110.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1067.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html · Vendor Advisory
• http://bugs.mysql.com/bug.php?id=32167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4098 · Security Note
• http://ubuntu.com/usn/USN-671-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:094 · Vendor Advisory
• http://ubuntu.com/usn/usn-897-1 · Vendor Advisory
• http://debian.org/security/2008/dsa-1662 · Vendor Advisory
• http://secunia.com/advisories/32578 · Note
• https://access.redhat.com/errata/RHSA-2010:0110 · Note
• http://openwall.com/lists/oss-security/2008/09/09/20 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0058.html · Note
• http://secunia.com/advisories/32759 · Note