PT-2020-6459 · Mariadb+1 · Mariadb+2

Matthias Gerstner

·

Published

2020-01-28

·

Updated

2025-06-10

·

CVE-2020-7221

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions MariaDB versions 10.4.7 through 10.4.11
Description The issue is related to the mysql install db function in MariaDB, which incorrectly defines a link before accessing a file. This can allow an attacker to escalate privileges from the mysql user account to root. The vulnerability can be exploited through a symlink attack on a chmod 04755 of auth pam tool dir/auth pam tool. It is noted that this issue does not affect the Oracle MySQL product, as it implements mysql install db differently.
Recommendations For MariaDB versions 10.4.7 through 10.4.11, consider restricting access to the mysql install db function until a patch is available. As a temporary workaround, avoid using the chown and chmod commands unsafely, and restrict access to the auth pam tool dir/auth pam tool directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2020-1240
ALT-PU-2020-1324
BDU:2021-05136
BIT-MARIADB-2020-7221
BIT-MARIADB-MIN-2020-7221
BIT-MYSQL-CLIENT-2020-7221
CVE-2020-7221
OPENSUSE-SU-2024:11038-1
SUSE-RU-2023:3956-1
SUSE-RU-2023:4991-1

Affected Products

Alt Linux
Mariadb
Mariadb Server