ID CVE-2008-7247
Summary sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink.
References
Vulnerable Configurations
  • MySQL 5.0
    cpe:2.3:a:mysql:mysql:5.0
  • MySQL MySQL 5.0.0
    cpe:2.3:a:mysql:mysql:5.0.0
  • MySQL MySQL 5.0.0 alpha
    cpe:2.3:a:mysql:mysql:5.0.0:alpha
  • MySQL MySQL 5.0.0.0
    cpe:2.3:a:mysql:mysql:5.0.0.0
  • MySQL MySQL 5.0.1
    cpe:2.3:a:mysql:mysql:5.0.1
  • MySQL MySQL 5.0.1a
    cpe:2.3:a:mysql:mysql:5.0.1a
  • MySQL MySQL 5.0.2
    cpe:2.3:a:mysql:mysql:5.0.2
  • MySQL MySQL 5.0.3
    cpe:2.3:a:mysql:mysql:5.0.3
  • MySQL MySQL 5.0.3 Beta
    cpe:2.3:a:mysql:mysql:5.0.3:beta
  • MySQL MySQL 5.0.3a
    cpe:2.3:a:mysql:mysql:5.0.3a
  • MySQL MySQL 5.0.4
    cpe:2.3:a:mysql:mysql:5.0.4
  • MySQL MySQL 5.0.4a
    cpe:2.3:a:mysql:mysql:5.0.4a
  • MySQL MySQL 5.0.5
    cpe:2.3:a:mysql:mysql:5.0.5
  • cpe:2.3:a:mysql:mysql:5.0.5.0.21
    cpe:2.3:a:mysql:mysql:5.0.5.0.21
  • MySQL MySQL 5.0.6
    cpe:2.3:a:mysql:mysql:5.0.6
  • MySQL MySQL 5.0.7
    cpe:2.3:a:mysql:mysql:5.0.7
  • MySQL MySQL 5.0.8
    cpe:2.3:a:mysql:mysql:5.0.8
  • MySQL MySQL 5.0.10
    cpe:2.3:a:mysql:mysql:5.0.10
  • MySQL MySQL 5.0.10a
    cpe:2.3:a:mysql:mysql:5.0.10a
  • MySQL MySQL 5.0.11
    cpe:2.3:a:mysql:mysql:5.0.11
  • MySQL MySQL 5.0.12
    cpe:2.3:a:mysql:mysql:5.0.12
  • MySQL MySQL 5.0.13
    cpe:2.3:a:mysql:mysql:5.0.13
  • MySQL MySQL 5.0.14
    cpe:2.3:a:mysql:mysql:5.0.14
  • MySQL MySQL 5.0.15
    cpe:2.3:a:mysql:mysql:5.0.15
  • MySQL MySQL 5.0.15a
    cpe:2.3:a:mysql:mysql:5.0.15a
  • MySQL MySQL 5.0.16
    cpe:2.3:a:mysql:mysql:5.0.16
  • MySQL MySQL 5.0.16a
    cpe:2.3:a:mysql:mysql:5.0.16a
  • MySQL MySQL 5.0.17
    cpe:2.3:a:mysql:mysql:5.0.17
  • MySQL MySQL 5.0.17a
    cpe:2.3:a:mysql:mysql:5.0.17a
  • MySQL MySQL 5.0.18
    cpe:2.3:a:mysql:mysql:5.0.18
  • MySQL MySQL 5.0.19
    cpe:2.3:a:mysql:mysql:5.0.19
  • MySQL MySQL 5.0.20
    cpe:2.3:a:mysql:mysql:5.0.20
  • MySQL MySQL 5.0.20a
    cpe:2.3:a:mysql:mysql:5.0.20a
  • MySQL MySQL 5.0.21
    cpe:2.3:a:mysql:mysql:5.0.21
  • MySQL MySQL 5.0.22
    cpe:2.3:a:mysql:mysql:5.0.22
  • cpe:2.3:a:mysql:mysql:5.0.22.1.0.1
    cpe:2.3:a:mysql:mysql:5.0.22.1.0.1
  • MySQL 5.0.23
    cpe:2.3:a:mysql:mysql:5.0.23
  • MySQL MySQL 5.0.24
    cpe:2.3:a:mysql:mysql:5.0.24
  • MySQL 5.0.24a
    cpe:2.3:a:mysql:mysql:5.0.24a
  • MySQL 5.0.25
    cpe:2.3:a:mysql:mysql:5.0.25
  • MySQL 5.0.26
    cpe:2.3:a:mysql:mysql:5.0.26
  • MySQL MySQL 5.0.27
    cpe:2.3:a:mysql:mysql:5.0.27
  • MySQL 5.0.30
    cpe:2.3:a:mysql:mysql:5.0.30
  • MySQL 5.0.30 Service Pack 1
    cpe:2.3:a:mysql:mysql:5.0.30:sp1
  • MySQL 5.0.32
    cpe:2.3:a:mysql:mysql:5.0.32
  • MySQL MySQL 5.0.33
    cpe:2.3:a:mysql:mysql:5.0.33
  • MySQL 5.0.36
    cpe:2.3:a:mysql:mysql:5.0.36
  • MySQL MySQL 5.0.37
    cpe:2.3:a:mysql:mysql:5.0.37
  • MySQL 5.0.38
    cpe:2.3:a:mysql:mysql:5.0.38
  • MySQL5.0.41
    cpe:2.3:a:mysql:mysql:5.0.41
  • MySQL5.0.42
    cpe:2.3:a:mysql:mysql:5.0.42
  • MySQL5.0.44
    cpe:2.3:a:mysql:mysql:5.0.44
  • MySQL5.0.45
    cpe:2.3:a:mysql:mysql:5.0.45
  • MySQL5.0.50
    cpe:2.3:a:mysql:mysql:5.0.50
  • cpe:2.3:a:mysql:mysql:5.0.51
    cpe:2.3:a:mysql:mysql:5.0.51
  • MySQL 5.0.51a
    cpe:2.3:a:mysql:mysql:5.0.51a
  • MySQL 5.0.51b
    cpe:2.3:a:mysql:mysql:5.0.51b
  • MySQL5.0.52
    cpe:2.3:a:mysql:mysql:5.0.52
  • MySQL5.0.54
    cpe:2.3:a:mysql:mysql:5.0.54
  • MySQL5.0.56
    cpe:2.3:a:mysql:mysql:5.0.56
  • MySQL5.0.60
    cpe:2.3:a:mysql:mysql:5.0.60
  • MySQL5.0.66
    cpe:2.3:a:mysql:mysql:5.0.66
  • MySQL5.0.75
    cpe:2.3:a:mysql:mysql:5.0.75
  • MySQL5.0.77
    cpe:2.3:a:mysql:mysql:5.0.77
  • Mysql 5.0.81
    cpe:2.3:a:mysql:mysql:5.0.81
  • MySQL5.0.82
    cpe:2.3:a:mysql:mysql:5.0.82
  • MySQL5.0.83
    cpe:2.3:a:mysql:mysql:5.0.83
  • MySQL 5.1
    cpe:2.3:a:mysql:mysql:5.1
  • MySQL 5.1.1
    cpe:2.3:a:mysql:mysql:5.1.1
  • MySQL 5.1.2
    cpe:2.3:a:mysql:mysql:5.1.2
  • MySQL 5.1.3
    cpe:2.3:a:mysql:mysql:5.1.3
  • MySQL 5.1.4
    cpe:2.3:a:mysql:mysql:5.1.4
  • MySQL 5.1.5
    cpe:2.3:a:mysql:mysql:5.1.5
  • MySQL 5.1.5a
    cpe:2.3:a:mysql:mysql:5.1.5a
  • MySQL 5.1.6
    cpe:2.3:a:mysql:mysql:5.1.6
  • MySQL 5.1.7
    cpe:2.3:a:mysql:mysql:5.1.7
  • MySQL 5.1.8
    cpe:2.3:a:mysql:mysql:5.1.8
  • MySQL 5.1.9
    cpe:2.3:a:mysql:mysql:5.1.9
  • MySQL 5.1.10
    cpe:2.3:a:mysql:mysql:5.1.10
  • MySQL 5.1.11
    cpe:2.3:a:mysql:mysql:5.1.11
  • MySQL 5.1.12
    cpe:2.3:a:mysql:mysql:5.1.12
  • MySQL 5.1.13
    cpe:2.3:a:mysql:mysql:5.1.13
  • MySQL 5.1.14
    cpe:2.3:a:mysql:mysql:5.1.14
  • MySQL 5.1.15
    cpe:2.3:a:mysql:mysql:5.1.15
  • MySQL 5.1.16
    cpe:2.3:a:mysql:mysql:5.1.16
  • MySQL 5.1.17
    cpe:2.3:a:mysql:mysql:5.1.17
  • MySQL 5.1.18
    cpe:2.3:a:mysql:mysql:5.1.18
  • MySQL 5.1.19
    cpe:2.3:a:mysql:mysql:5.1.19
  • MySQL 5.1.20
    cpe:2.3:a:mysql:mysql:5.1.20
  • MySQL 5.1.21
    cpe:2.3:a:mysql:mysql:5.1.21
  • MySQL 5.1.22
    cpe:2.3:a:mysql:mysql:5.1.22
  • MySQL 5.1.23
    cpe:2.3:a:mysql:mysql:5.1.23
  • MySQL 5.1.23_bk
    cpe:2.3:a:mysql:mysql:5.1.23_bk
  • MySQL 5.1.23a
    cpe:2.3:a:mysql:mysql:5.1.23a
  • MySQL 5.1.30
    cpe:2.3:a:mysql:mysql:5.1.30
  • MySQL 5.1.32-bzr
    cpe:2.3:a:mysql:mysql:5.1.32-bzr
  • MySQL MySQL 6.0.0
    cpe:2.3:a:mysql:mysql:6.0.0
  • MySQL MySQL 6.0.1
    cpe:2.3:a:mysql:mysql:6.0.1
  • MySQL MySQL 6.0.2
    cpe:2.3:a:mysql:mysql:6.0.2
  • MySQL MySQL 6.0.3
    cpe:2.3:a:mysql:mysql:6.0.3
  • MySQL MySQL 6.0.4
    cpe:2.3:a:mysql:mysql:6.0.4
  • cpe:2.3:a:mysql:mysql:6.0.9
    cpe:2.3:a:mysql:mysql:6.0.9
CVSS
Base: 6.0 (as of 01-12-2009 - 07:53)
Impact:
Exploitability:
CWE CWE-59
CAPEC
  • Symlink Attack
    An attacker positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name. The endpoint file may be either output or input. If the file is output, the result is that the endpoint is modified, instead of a file at the intended location. Modifications to the endpoint file may include appending, overwriting, corrupting, changing permissions, or other modifications. In some variants of this attack the attacker may be able to control the change to a file while in other cases they cannot. The former is especially damaging since the attacker may be able to grant themselves increased privileges or insert false information, but the latter can also be damaging as it can expose sensitive information or corrupt or destroy vital system or application files. Alternatively, the endpoint file may serve as input to the targeted application. This can be used to feed malformed input into the target or to cause the target to process different information, possibly allowing the attacker to control the actions of the target or to cause the target to expose information to the attacker. Moreover, the actions taken on the endpoint file are undertaken with the permissions of the targeted user or application, which may exceed the permissions that the attacker would normally have.
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access
VectorComplexityAuthentication
NETWORK MEDIUM SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1397-1.NASL
    description Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information : http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 58325
    published 2012-03-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=58325
    title Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)
  • NASL family Databases
    NASL id MYSQL_6_0_9.NASL
    description The version of MySQL installed on the remote host is older than 6.0.9-alpha / 5.5.3. As such, it reportedly allows a remote attacker to bypass access restrictions when the data directory contains a symbolic link to a different file system.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 17837
    published 2012-01-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=17837
    title MySQL < 6.0.9-alpha / 5.5.3 Access Control Weakness
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2010-1348.NASL
    description Add backported patch for CVE-2008-7247 Use non-expired certificates for SSL testing Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 47248
    published 2010-07-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47248
    title Fedora 12 : mysql-5.1.42-7.fc12 (2010-1348)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2010-044.NASL
    description A vulnerability has been found and corrected in mysql : MySQL is vulnerable to a symbolic link attack when the data home directory contains a symlink to a different filesystem which allows remote authenticated users to bypass intended access restrictions (CVE-2008-7247). The updated packages have been patched to correct these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 48175
    published 2010-07-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=48175
    title Mandriva Linux Security Advisory : mysql (MDVSA-2010:044)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2010-1300.NASL
    description Add backported patch for CVE-2008-7247 Use non-expired certificates for SSL testing Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 47246
    published 2010-07-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47246
    title Fedora 11 : mysql-5.1.42-7.fc11 (2010-1300)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201201-02.NASL
    description The remote host is affected by the vulnerability described in GLSA-201201-02 (MySQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in MySQL. Please review the CVE identifiers referenced below for details. Impact : An unauthenticated remote attacker may be able to execute arbitrary code with the privileges of the MySQL process, cause a Denial of Service condition, bypass security restrictions, uninstall arbitrary MySQL plugins, or conduct Man-in-the-Middle and Cross-Site Scripting attacks. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 57446
    published 2012-01-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57446
    title GLSA-201201-02 : MySQL: Multiple vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_6_3.NASL
    description The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3. Mac OS X 10.6.3 contains security fixes for the following products : - AFP Server - Apache - CoreAudio - CoreMedia - CoreTypes - CUPS - DesktopServices - Disk Images - Directory Services - Dovecot - Event Monitor - FreeRADIUS - FTP Server - iChat Server - ImageIO - Image RAW - Libsystem - Mail - MySQL - OS Services - Password Server - PHP - Podcast Producer - Preferences - PS Normalizer - QuickTime - Ruby - Server Admin - SMB - Tomcat - Wiki Server - X11
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 45372
    published 2010-03-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=45372
    title Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS11_MYSQL_20130924.NASL
    description The remote Solaris system is missing necessary patches to address security updates : - MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097. (CVE-2008-4098) - sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink. (CVE-2008-7247) - MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247. (CVE-2010-1626) - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error. (CVE-2013-1861)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 80705
    published 2015-01-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80705
    title Oracle Solaris Third-Party Patch Update : mysql (multiple_vulnerabilities_in_mysql)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_2_LIBMYSQLCLIENT-DEVEL-100401.NASL
    description Updated mysql packages fix the following bugs : - upstream #47320 - checking server certificates (CVE-2009-4028) - upstream #48291 - error handling in subqueries (CVE-2009-4019) - upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) - upstream #39277 - symlink behaviour fixed (CVE-2008-7247) - upstream #32167 - symlink behaviour refixed (CVE-2009-4030)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 46235
    published 2010-05-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46235
    title openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_LIBMYSQLCLIENT-DEVEL-100429.NASL
    description Updated MySQL packages fix the following bugs : - upstream #47320 - checking server certificates. (CVE-2009-4028) - upstream #48291 - error handling in subqueries. (CVE-2009-4019) - upstream #47780 - preserving null_value flag in GeomFromWKB(). (CVE-2009-4019) - upstream #39277 - symlink behaviour fixed. (CVE-2008-7247) - upstream #32167 - symlink behaviour refixed (CVE-2009-4030)
    last seen 2019-02-21
    modified 2016-12-21
    plugin id 50935
    published 2010-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50935
    title SuSE 11 Security Update : MySQL (SAT Patch Number 2317)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_0_LIBMYSQLCLIENT-DEVEL-091216.NASL
    description This update fixes several security issues in mysql : - checking server certificates (CVE-2009-4028) - error handling in subqueries (CVE-2009-4019) - preserving null_value flag in GeomFromWKB (CVE-2009-4019) - symlink behavior fixed (CVE-2008-7247) - symlink behavior refixed (CVE-2009-4030)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 46218
    published 2010-05-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46218
    title openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-897-1.NASL
    description It was discovered that MySQL could be made to overwrite existing table files in the data directory. An authenticated user could use the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks. This update alters table creation behaviour by disallowing the use of the MySQL data directory in DATA DIRECTORY and INDEX DIRECTORY options. This issue only affected Ubuntu 8.10. (CVE-2008-4098) It was discovered that MySQL contained a cross-site scripting vulnerability in the command-line client when the --html option is enabled. An attacker could place arbitrary web script or html in a database cell, which would then get placed in the html document output by the command-line tool. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04. (CVE-2008-4456) It was discovered that MySQL could be made to overwrite existing table files in the data directory. An authenticated user could use symlinks combined with the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks. This issue only affected Ubuntu 9.10. (CVE-2008-7247) It was discovered that MySQL contained multiple format string flaws when logging database creation and deletion. An authenticated user could use specially crafted database names to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04. (CVE-2009-2446) It was discovered that MySQL incorrectly handled errors when performing certain SELECT statements, and did not preserve correct flags when performing statements that use the GeomFromWKB function. An authenticated user could exploit this to make MySQL crash, causing a denial of service. (CVE-2009-4019) It was discovered that MySQL incorrectly checked symlinks when using the DATA DIRECTORY and INDEX DIRECTORY options. A local user could use symlinks to create tables that pointed to tables known to be created at a later time, bypassing access restrictions. (CVE-2009-4030) It was discovered that MySQL contained a buffer overflow when parsing ssl certificates. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 LTS and the default compiler options for affected releases should reduce the vulnerability to a denial of service. In the default installation, attackers would also be isolated by the AppArmor MySQL profile. (CVE-2009-4484). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 44585
    published 2010-02-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=44585
    title Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-897-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE9_12661.NASL
    description The following bugs have been fixed : - local users could delete data files for tables of other users. (CVE-2010-1626) - authenticated users could gather information for tables they should not have access to. (CVE-2010-1849) - authenticated users could crash mysqld. (CVE-2010-3683, CVE-2010-3681, CVE-2010-1848) - authenticated users could bypass intended access restrictions. (CVE-2008-7247, CVE-2009-4030)
    last seen 2019-02-21
    modified 2012-04-23
    plugin id 50523
    published 2010-11-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50523
    title SuSE9 Security Update : MySQL (YOU Patch Number 12661)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_1_LIBMYSQLCLIENT-DEVEL-091216.NASL
    description This update fixes several security issues in mysql : - checking server certificates (CVE-2009-4028) - error handling in subqueries (CVE-2009-4019) - preserving null_value flag in GeomFromWKB (CVE-2009-4019) - symlink behavior fixed (CVE-2008-7247) - symlink behavior refixed (CVE-2009-4030)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 46219
    published 2010-05-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46219
    title openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)
  • NASL family Databases
    NASL id MYSQL_5_0_88.NASL
    description The version of MySQL 5.0 installed on the remote host is earlier than 5.0.88. It is, therefore, potentially affected by the following vulnerabilities : - MySQL clients linked against OpenSSL are vulnerable to man-in-the-middle attacks. (Bug #47320) - The GeomFromWKB() function can be manipulated to cause a denial of service. (Bug #47780) - Specially crafted SELECT statements containing sub- queries in the WHERE clause can cause the server to crash. (Bug #48291) - It is possible to bypass access restrictions when the data directory contains a symbolic link to a different file system. (Bug #39277)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 42899
    published 2009-11-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42899
    title MySQL 5.0 < 5.0.88 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_2_LIBMYSQLCLIENT-DEVEL-091215.NASL
    description This update fixes several security issues in mysql : - checking server certificates (CVE-2009-4028) - error handling in subqueries (CVE-2009-4019) - preserving null_value flag in GeomFromWKB (CVE-2009-4019) - symlink behavior fixed (CVE-2008-7247) - symlink behavior refixed (CVE-2009-4030)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 46220
    published 2010-05-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46220
    title openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_MYSQL-6897.NASL
    description This update fixes various security issues (bnc#557669) : upstream #47320 - checking server certificates (CVE-2009-4028) upstream #48291 - error handling in subqueries (CVE-2009-4019) upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) upstream #39277 - symlink behaviour fixed (CVE-2008-7247) upstream #32167 - symlink behaviour refixed (CVE-2009-4030) fixing remote buffer overflow. (CVE-2009-4484)
    last seen 2019-02-21
    modified 2016-12-22
    plugin id 45107
    published 2010-03-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=45107
    title SuSE 10 Security Update : MySQL (ZYPP Patch Number 6897)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_0_LIBMYSQLCLIENT-DEVEL-100504.NASL
    description Updated mysql packages fix the following bugs : - upstream #47320 - checking server certificates (CVE-2009-4028) - upstream #48291 - error handling in subqueries (CVE-2009-4019) - upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) - upstream #39277 - symlink behaviour fixed (CVE-2008-7247) - upstream #32167 - symlink behaviour refixed (CVE-2009-4030)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 46229
    published 2010-05-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46229
    title openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_1_LIBMYSQLCLIENT-DEVEL-100401.NASL
    description Updated mysql packages fix the following bugs : - upstream #47320 - checking server certificates (CVE-2009-4028) - upstream #48291 - error handling in subqueries (CVE-2009-4019) - upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) - upstream #39277 - symlink behaviour fixed (CVE-2008-7247) - upstream #32167 - symlink behaviour refixed (CVE-2009-4030)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 46232
    published 2010-05-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46232
    title openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_MYSQL-6899.NASL
    description This update fixes various security issues (bnc#557669) : upstream #47320 - checking server certificates (CVE-2009-4028) upstream #48291 - error handling in subqueries (CVE-2009-4019) upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) upstream #39277 - symlink behaviour fixed (CVE-2008-7247) upstream #32167 - symlink behaviour refixed (CVE-2009-4030) fixing remote buffer overflow. (CVE-2009-4484)
    last seen 2019-02-21
    modified 2016-12-22
    plugin id 49903
    published 2010-10-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=49903
    title SuSE 10 Security Update : MySQL (ZYPP Patch Number 6899)
  • NASL family Databases
    NASL id MYSQL_5_1_41.NASL
    description The version of MySQL 5.1 installed on the remote host is earlier than 5.1.41 and is, therefore, potentially affected by the following vulnerabilities : - An incomplete fix was provided in 5.1.24 for CVE-2008-2079, a symlink-related privilege escalation issue. (Bug #39277) - MySQL clients linked against OpenSSL are vulnerable to man-in-the-middle attacks. (Bug #47320) - The GeomFromWKB() function can be manipulated to cause a denial of service. (Bug #47780) - Specially crafted SELECT statements containing sub- queries in the WHERE clause can cause the server to crash. (Bug #48291)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 42900
    published 2009-11-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42900
    title MySQL 5.1 < 5.1.41 Multiple Vulnerabilities
refmap via4
apple APPLE-SA-2010-03-29-1
bid 38043
confirm
mandriva MDVSA-2010:044
misc https://bugzilla.redhat.com/show_bug.cgi?id=543619
mlist
  • [commits] 20081124 bzr commit into mysql-6.0-backup branch (ingo.struewing:2744) Bug#39277
  • [oss-security] 20091124 Re: mysql-5.1.41
secunia 38517
suse
  • SUSE-SR:2010:011
  • SUSE-SR:2010:021
ubuntu
  • USN-1397-1
  • USN-897-1
vupen ADV-2010-1107
statements via4
contributor Tomas Hoger
lastmodified 2009-12-21
organization Red Hat
statement Not vulnerable. This issue did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 3, 4, or 5.
Last major update 14-01-2011 - 01:30
Published 30-11-2009 - 12:30
Last modified 04-01-2018 - 21:29
Back to Top