ID CVE-2004-0381
Summary mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file.
References
Vulnerable Configurations
  • MySQL MySQL 3.20.32a
    cpe:2.3:a:mysql:mysql:3.20.32a
  • MySQL MySQL 3.22.26
    cpe:2.3:a:mysql:mysql:3.22.26
  • MySQL MySQL 3.22.27
    cpe:2.3:a:mysql:mysql:3.22.27
  • MySQL MySQL 3.22.28
    cpe:2.3:a:mysql:mysql:3.22.28
  • MySQL MySQL 3.22.29
    cpe:2.3:a:mysql:mysql:3.22.29
  • MySQL MySQL 3.22.30
    cpe:2.3:a:mysql:mysql:3.22.30
  • MySQL MySQL 3.22.32
    cpe:2.3:a:mysql:mysql:3.22.32
  • MySQL MySQL 3.23.2
    cpe:2.3:a:mysql:mysql:3.23.2
  • MySQL MySQL 3.23.3
    cpe:2.3:a:mysql:mysql:3.23.3
  • MySQL MySQL 3.23.5
    cpe:2.3:a:mysql:mysql:3.23.5
  • MySQL MySQL 3.23.8
    cpe:2.3:a:mysql:mysql:3.23.8
  • MySQL MySQL 3.23.9
    cpe:2.3:a:mysql:mysql:3.23.9
  • MySQL MySQL 3.23.10
    cpe:2.3:a:mysql:mysql:3.23.10
  • MySQL MySQL 3.23.22
    cpe:2.3:a:mysql:mysql:3.23.22
  • MySQL MySQL 3.23.23
    cpe:2.3:a:mysql:mysql:3.23.23
  • MySQL MySQL 3.23.24
    cpe:2.3:a:mysql:mysql:3.23.24
  • MySQL MySQL 3.23.25
    cpe:2.3:a:mysql:mysql:3.23.25
  • MySQL MySQL 3.23.26
    cpe:2.3:a:mysql:mysql:3.23.26
  • MySQL MySQL 3.23.27
    cpe:2.3:a:mysql:mysql:3.23.27
  • MySQL MySQL 3.23.28
    cpe:2.3:a:mysql:mysql:3.23.28
  • MySQL MySQL 3.23.28 gamma
    cpe:2.3:a:mysql:mysql:3.23.28:gamma
  • MySQL MySQL 3.23.29
    cpe:2.3:a:mysql:mysql:3.23.29
  • MySQL MySQL 3.23.30
    cpe:2.3:a:mysql:mysql:3.23.30
  • MySQL MySQL 3.23.31
    cpe:2.3:a:mysql:mysql:3.23.31
  • MySQL MySQL 3.23.32
    cpe:2.3:a:mysql:mysql:3.23.32
  • MySQL MySQL 3.23.33
    cpe:2.3:a:mysql:mysql:3.23.33
  • MySQL MySQL 3.23.34
    cpe:2.3:a:mysql:mysql:3.23.34
  • MySQL MySQL 3.23.36
    cpe:2.3:a:mysql:mysql:3.23.36
  • MySQL MySQL 3.23.37
    cpe:2.3:a:mysql:mysql:3.23.37
  • MySQL MySQL 3.23.38
    cpe:2.3:a:mysql:mysql:3.23.38
  • MySQL MySQL 3.23.39
    cpe:2.3:a:mysql:mysql:3.23.39
  • MySQL MySQL 3.23.40
    cpe:2.3:a:mysql:mysql:3.23.40
  • MySQL MySQL 3.23.41
    cpe:2.3:a:mysql:mysql:3.23.41
  • MySQL MySQL 3.23.42
    cpe:2.3:a:mysql:mysql:3.23.42
  • MySQL MySQL 3.23.43
    cpe:2.3:a:mysql:mysql:3.23.43
  • MySQL MySQL 3.23.44
    cpe:2.3:a:mysql:mysql:3.23.44
  • MySQL MySQL 3.23.45
    cpe:2.3:a:mysql:mysql:3.23.45
  • MySQL MySQL 3.23.46
    cpe:2.3:a:mysql:mysql:3.23.46
  • MySQL MySQL 3.23.47
    cpe:2.3:a:mysql:mysql:3.23.47
  • MySQL MySQL 3.23.48
    cpe:2.3:a:mysql:mysql:3.23.48
  • MySQL MySQL 3.23.49
    cpe:2.3:a:mysql:mysql:3.23.49
  • MySQL MySQL 3.23.50
    cpe:2.3:a:mysql:mysql:3.23.50
  • MySQL MySQL 3.23.51
    cpe:2.3:a:mysql:mysql:3.23.51
  • MySQL MySQL 3.23.52
    cpe:2.3:a:mysql:mysql:3.23.52
  • MySQL MySQL 3.23.53
    cpe:2.3:a:mysql:mysql:3.23.53
  • MySQL MySQL 3.23.53a
    cpe:2.3:a:mysql:mysql:3.23.53a
  • MySQL MySQL 3.23.54
    cpe:2.3:a:mysql:mysql:3.23.54
  • MySQL MySQL 3.23.54a
    cpe:2.3:a:mysql:mysql:3.23.54a
  • MySQL MySQL 3.23.55
    cpe:2.3:a:mysql:mysql:3.23.55
  • MySQL MySQL 3.23.56
    cpe:2.3:a:mysql:mysql:3.23.56
  • MySQL MySQL 3.23.58
    cpe:2.3:a:mysql:mysql:3.23.58
  • MySQL MySQL 4.0.0
    cpe:2.3:a:mysql:mysql:4.0.0
  • MySQL MySQL 4.0.1
    cpe:2.3:a:mysql:mysql:4.0.1
  • MySQL MySQL 4.0.2
    cpe:2.3:a:mysql:mysql:4.0.2
  • MySQL MySQL 4.0.3
    cpe:2.3:a:mysql:mysql:4.0.3
  • MySQL MySQL 4.0.4
    cpe:2.3:a:mysql:mysql:4.0.4
  • MySQL MySQL 4.0.5
    cpe:2.3:a:mysql:mysql:4.0.5
  • MySQL MySQL 4.0.5a
    cpe:2.3:a:mysql:mysql:4.0.5a
  • MySQL MySQL 4.0.6
    cpe:2.3:a:mysql:mysql:4.0.6
  • MySQL MySQL 4.0.7
    cpe:2.3:a:mysql:mysql:4.0.7
  • MySQL MySQL 4.0.7 gamma
    cpe:2.3:a:mysql:mysql:4.0.7:gamma
  • MySQL MySQL 4.0.8
    cpe:2.3:a:mysql:mysql:4.0.8
  • MySQL MySQL 4.0.8 gamma
    cpe:2.3:a:mysql:mysql:4.0.8:gamma
  • MySQL MySQL 4.0.9
    cpe:2.3:a:mysql:mysql:4.0.9
  • MySQL MySQL 4.0.9 gamma
    cpe:2.3:a:mysql:mysql:4.0.9:gamma
  • MySQL MySQL 4.0.10
    cpe:2.3:a:mysql:mysql:4.0.10
  • MySQL MySQL 4.0.11
    cpe:2.3:a:mysql:mysql:4.0.11
  • MySQL MySQL 4.0.11 gamma
    cpe:2.3:a:mysql:mysql:4.0.11:gamma
  • MySQL MySQL 4.0.12
    cpe:2.3:a:mysql:mysql:4.0.12
  • MySQL MySQL 4.0.13
    cpe:2.3:a:mysql:mysql:4.0.13
  • MySQL MySQL 4.0.14
    cpe:2.3:a:mysql:mysql:4.0.14
  • MySQL MySQL 4.0.15
    cpe:2.3:a:mysql:mysql:4.0.15
  • MySQL MySQL 4.0.18
    cpe:2.3:a:mysql:mysql:4.0.18
  • MySQL MySQL 4.1.0 alpha
    cpe:2.3:a:mysql:mysql:4.1.0:alpha
  • MySQL MySQL 4.1.0.0
    cpe:2.3:a:mysql:mysql:4.1.0.0
CVSS
Base: 2.1 (as of 01-01-2004 - 00:00)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
nessus via4
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_MYSQL_CLIENT_4020.NASL
    description The following package needs to be updated: mysql-client
    last seen 2016-09-26
    modified 2011-10-03
    plugin id 12583
    published 2004-07-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=12583
    title FreeBSD : MySQL insecure temporary file creation (mysqlbug) (123)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_2E1298468FBB11D88B290020ED76EF5A.NASL
    description Shaun Colley reports that the script `mysqlbug' included with MySQL sometimes creates temporary files in an unsafe manner. As a result, an attacker may create a symlink in /tmp so that if another user invokes `mysqlbug' and quits without making any changes, an arbitrary file may be overwritten with the bug report template.
    last seen 2019-02-21
    modified 2018-11-21
    plugin id 37467
    published 2009-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=37467
    title FreeBSD : MySQL insecure temporary file creation (mysqlbug) (2e129846-8fbb-11d8-8b29-0020ed76ef5a)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2004-597.NASL
    description Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1. MySQL is a multi-user, multi-threaded SQL database server. A number security issues that affect the mysql server have been reported : Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue. Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836). Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837). Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957). Additionally, the following minor temporary file vulnerabilities were discovered : - Stan Bubroski and Shaun Colley found a temporary file vulnerability in the mysqlbug script (CVE-2004-0381). - A temporary file vulnerability was discovered in mysqld_multi (CVE-2004-0388). - Jeroen van Wolffelaar discovered an temporary file vulnerability in the mysqlhotcopy script when using the scp method (CVE-2004-0457). All users of mysql should upgrade to these updated packages, which resolve these issues and also include fixes for a number of small bugs.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 15536
    published 2004-10-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=15536
    title RHEL 2.1 : mysql (RHSA-2004:597)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200405-20.NASL
    description The remote host is affected by the vulnerability described in GLSA-200405-20 (Insecure Temporary File Creation In MySQL) The MySQL bug reporting utility (mysqlbug) creates a temporary file to log bug reports to. A malicious local user with write access to the /tmp directory could create a symbolic link of the name mysqlbug-N pointing to a protected file, such as /etc/passwd, such that when mysqlbug creates the Nth log file, it would end up overwriting the target file. A similar vulnerability exists with the mysql_multi utility, which creates a temporary file called mysql_multi.log. Impact : Since mysql_multi runs as root, a local attacker could use this to destroy any other users' data or corrupt and destroy system files. Workaround : One could modify both scripts to log to a directory that users do not have write permission to, such as /var/log/mysql/.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 14506
    published 2004-08-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=14506
    title GLSA-200405-20 : Insecure Temporary File Creation In MySQL
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-483.NASL
    description Two vulnerabilities have been discovered in mysql, a common database system. Two scripts contained in the package don't create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking the MySQL server, which is often the root user. The Common Vulnerabilities and Exposures identifies the following problems : - CAN-2004-0381 The script mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack. - CAN-2004-0388 The script mysqld_multi in MySQL allows local users to overwrite arbitrary files via a symlink attack.
    last seen 2019-02-21
    modified 2018-07-20
    plugin id 15320
    published 2004-09-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=15320
    title Debian DSA-483-1 : mysql - insecure temporary file creation
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2004-569.NASL
    description Updated mysql packages that fix various temporary file security issues, as well as a number of bugs, are now available. MySQL is a multi-user, multi-threaded SQL database server. This update fixes a number of small bugs, including some potential security problems associated with careless handling of temporary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0381, CVE-2004-0388, and CVE-2004-0457 to these issues. A number of additional security issues that affect mysql have been corrected in the source package. These include CVE-2004-0835, CVE-2004-0836, CVE-2004-0837, and CVE-2004-0957. Red Hat Enterprise Linux 3 does not ship with the mysql-server package and is therefore not affected by these issues. This update also allows 32-bit and 64-bit libraries to be installed concurrently on the same system. All users of mysql should upgrade to these updated packages, which resolve these issues.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 15534
    published 2004-10-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=15534
    title RHEL 3 : mysql (RHSA-2004:569)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2004-034.NASL
    description Shaun Colley discovered that two scripts distributed with MySQL, the 'mysqld_multi' and 'mysqlbug' scripts, did not create temporary files in a secure fashion. An attacker could create symbolic links in /tmp that could allow for overwriting of files with the privileges of the user running the scripts. The scripts have been patched in the updated packages to prevent this behaviour.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 14133
    published 2004-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=14133
    title Mandrake Linux Security Advisory : MySQL (MDKSA-2004:034)
  • NASL family Databases
    NASL id MYSQL_4_0_20.NASL
    description The version of MySQL installed on the remote host is older than 4.0.20. A local attacker could exploit a flaw in mysqlbug to overwite arbitrary files via a symlink attack.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 17823
    published 2012-01-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=17823
    title MySQL < 4.0.20 File Overwrite
oval via4
accepted 2013-04-29T04:14:41.367-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
description mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file.
family unix
id oval:org.mitre.oval:def:11557
status accepted
submitted 2010-07-09T03:56:16-04:00
title mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file.
version 24
redhat via4
advisories
  • rhsa
    id RHSA-2004:569
  • rhsa
    id RHSA-2004:597
refmap via4
bid 9976
bugtraq
  • 20040324 mysqlbug tmpfile/symlink vulnerability.
  • 20040414 [OpenPKG-SA-2004.014] OpenPKG Security Advisory (mysql)
ciac P-018
debian DSA-483
gentoo GLSA-200405-20
mandrake MDKSA-2004:034
xf mysql-mysqlbug-symlink(15617)
Last major update 17-10-2016 - 22:44
Published 04-05-2004 - 00:00
Last modified 10-10-2017 - 21:29
Back to Top