PT-2012-6060 · Mariadb Foundation+2 · Mariadb+2

Huzaifa Sidhpurwala · Published 2012-12-03 · Updated 2024-08-06 · CVE-2012-5613

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQL versions 5.5.19 and possibly other versions MariaDB versions 5.5.28a and possibly other versions

Description The issue allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator, when configured to assign the FILE privilege to users who should not have administrative privileges. The vendor disputes this issue, stating that it is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation.

Recommendations For MySQL version 5.5.19, consider restricting the FILE privilege to only administrative users. For MariaDB version 5.5.28a, consider restricting the FILE privilege to only administrative users. As a temporary workaround, consider disabling the assignment of the FILE privilege to non-administrative users until a proper configuration is in place. Restrict access to sensitive files and directories to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2012-5613

Affected Products

Mariadb

Mysql Server

Suse

References · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/mysql/mysql_mof.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/mysql/mysql_start_up.rb · Exploit
• 🔥 https://github.com/Hood3dRob1n/MySQL-Fu.rb · Exploit
• 🔥 https://exploit-db.com/exploits/23179 · Exploit
• 🔥 https://exploit-db.com/exploits/23077 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2012/Dec/6 · Exploit
• 🔥 https://exploit-db.com/exploits/35777 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201308-06.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5613 · Security Note
• https://t.me/cvenotify/89529 · Telegram Post
• http://secunia.com/advisories/53372 · Note
• https://t.me/cvenotify/80283 · Telegram Post
• http://openwall.com/lists/oss-security/2012/12/02/3 · Note
• http://openwall.com/lists/oss-security/2012/12/02/4 · Note