cnvd - cnvd-2020-04539

cnvd-2020-04539

Vulnerability from cnvd

Title

MariaDB mysql_install_db脚本权限提升漏洞

Description

MariaDB数据库管理系统是MySQL的一个分支，主要由开源社区在维护，采用GPL授权许可。 MariaDB的目的是完全兼容MySQL，包括API和命令行，使之能轻松成为MySQL的代替品。 MariaDB mysql_install_db脚本存在权限提升漏洞，攻击者可通过使用symlink攻击利用该漏洞从mysql用户帐户到根用户获得提升的特权。

Severity

高

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://mariadb.org/

Reference

https://exchange.xforce.ibmcloud.com/vulnerabilities/175717

Impacted products

Name
MariaDB MariaDB

Show details on source website

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-7221"
    }
  },
  "description": "MariaDB\u6570\u636e\u5e93\u7ba1\u7406\u7cfb\u7edf\u662fMySQL\u7684\u4e00\u4e2a\u5206\u652f\uff0c\u4e3b\u8981\u7531\u5f00\u6e90\u793e\u533a\u5728\u7ef4\u62a4\uff0c\u91c7\u7528GPL\u6388\u6743\u8bb8\u53ef\u3002 MariaDB\u7684\u76ee\u7684\u662f\u5b8c\u5168\u517c\u5bb9MySQL\uff0c\u5305\u62ecAPI\u548c\u547d\u4ee4\u884c\uff0c\u4f7f\u4e4b\u80fd\u8f7b\u677e\u6210\u4e3aMySQL\u7684\u4ee3\u66ff\u54c1\u3002\n\nMariaDB mysql_install_db\u811a\u672c\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u4f7f\u7528symlink\u653b\u51fb\u5229\u7528\u8be5\u6f0f\u6d1e\u4ecemysql\u7528\u6237\u5e10\u6237\u5230\u6839\u7528\u6237\u83b7\u5f97\u63d0\u5347\u7684\u7279\u6743\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://mariadb.org/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-04539",
  "openTime": "2020-02-11",
  "products": {
    "product": "MariaDB MariaDB"
  },
  "referenceLink": "https://exchange.xforce.ibmcloud.com/vulnerabilities/175717",
  "serverity": "\u9ad8",
  "submitTime": "2020-02-06",
  "title": "MariaDB mysql_install_db\u811a\u672c\u6743\u9650\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2020-7221 (GCVE-0-2020-7221)

Vulnerability from cvelistv5

Published

2020-02-04 16:57

Modified

2024-08-04 09:25

Severity ?

CWE

n/a

Summary

mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated by a symlink attack on a chmod 04755 of auth_pam_tool_dir/auth_pam_tool. NOTE: this does not affect the Oracle MySQL product, which implements mysql_install_db differently.

References

URL

Tags

	https://seclists.org/oss-sec/2020/q1/55	x_refsource_MISC
	https://bugzilla.suse.com/show_bug.cgi?id=1160868	x_refsource_MISC
	https://github.com/MariaDB/server/commit/9d18b6246755472c8324bf3e20e234e08ac45618	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:25:48.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://seclists.org/oss-sec/2020/q1/55"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160868"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/MariaDB/server/commit/9d18b6246755472c8324bf3e20e234e08ac45618"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2020-01-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated by a symlink attack on a chmod 04755 of auth_pam_tool_dir/auth_pam_tool. NOTE: this does not affect the Oracle MySQL product, which implements mysql_install_db differently."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-04T16:57:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://seclists.org/oss-sec/2020/q1/55"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160868"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/MariaDB/server/commit/9d18b6246755472c8324bf3e20e234e08ac45618"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-7221",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated by a symlink attack on a chmod 04755 of auth_pam_tool_dir/auth_pam_tool. NOTE: this does not affect the Oracle MySQL product, which implements mysql_install_db differently."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://seclists.org/oss-sec/2020/q1/55",
              "refsource": "MISC",
              "url": "https://seclists.org/oss-sec/2020/q1/55"
            },
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1160868",
              "refsource": "MISC",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160868"
            },
            {
              "name": "https://github.com/MariaDB/server/commit/9d18b6246755472c8324bf3e20e234e08ac45618",
              "refsource": "CONFIRM",
              "url": "https://github.com/MariaDB/server/commit/9d18b6246755472c8324bf3e20e234e08ac45618"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-7221",
    "datePublished": "2020-02-04T16:57:00",
    "dateReserved": "2020-01-17T00:00:00",
    "dateUpdated": "2024-08-04T09:25:48.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.