Published: 18/09/2008 Updated: 17/12/2019

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

VMScore: 411

Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P

MySQL prior to 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 9.04
canonical ubuntu linux 8.10
canonical ubuntu linux 6.06
canonical ubuntu linux 8.04
canonical ubuntu linux 7.10
canonical ubuntu linux 9.10
debian debian linux 5.0
mysql mysql 5.0.3
mysql mysql 5.0.4
mysql mysql 5.0.20
oracle mysql 5.0.26
oracle mysql 5.0.28
oracle mysql 5.0.36
oracle mysql 5.0.45
oracle mysql 5.0.46
oracle mysql 5.0.52
mysql mysql 5.0.54
mysql mysql 5.0.5
mysql mysql 5.0.15
mysql mysql 5.0.30
oracle mysql 5.0.30
mysql mysql 5.0.1
mysql mysql 5.0.2
mysql mysql 5.0.10
oracle mysql 5.0.25
oracle mysql 5.0.34
mysql mysql 5.0.36
mysql mysql 5.0.44
oracle mysql 5.0.44
oracle mysql 5.0.51
oracle mysql 5.0.60
oracle mysql 5.0.62
oracle mysql 5.0.38
oracle mysql 5.0.40
oracle mysql 5.0.48
oracle mysql 5.0.50
mysql mysql 5.0.56
oracle mysql 5.0.56
oracle mysql 5.0.66
mysql mysql 5.0.66
oracle mysql 5.0.64
mysql mysql 5.0.0
mysql mysql 5.0.16
mysql mysql 5.0.17
oracle mysql 5.0.23
mysql mysql 5.0.24
oracle mysql 5.0.32
oracle mysql 5.0.41
oracle mysql 5.0.42
oracle mysql 5.0.58
mysql mysql 5.0.60

Synopsis Moderate: mysql security update Type/Severity Security Advisory: Moderate Topic Updated mysql packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 5This update has been rated as having moderate security impact by the RedHat Security Response Team Descr ...

Synopsis Moderate: mysql security update Type/Severity Security Advisory: Moderate Topic Updated mysql packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4This update has been rated as having moderate security impact by the RedHat Security Response Team Descri ...

A symlink traversal vulnerability was discovered in MySQL, a relational database server The weakness could permit an attacker having both CREATE TABLE access to a database and the ability to execute shell commands on the database server to bypass MySQL access controls, enabling them to write to tables in databases to which they would not ordinaril ...

It was discovered that MySQL could be made to overwrite existing table files in the data directory An authenticated user could use the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks This update alters table creation behaviour by disallowing the use of the MySQL data directory in DATA DIRECTORY and INDEX DIRECTORY o ...

Several security issues were fixed in MySQL ...

It was discovered that MySQL could be made to overwrite existing table files in the data directory An authenticated user could use the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks This update alters table creation behaviour by disallowing the use of the MySQL data directory in DATA DIRECTORY and INDEX DIRECTORY o ...

CWE-59 http://www.openwall.com/lists/oss-security/2008/09/16/3 http://www.openwall.com/lists/oss-security/2008/09/09/20 http://bugs.mysql.com/bug.php?id=32167 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25 http://secunia.com/advisories/32759 http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:094 http://www.redhat.com/support/errata/RHSA-2009-1067.html http://www.redhat.com/support/errata/RHSA-2010-0110.html http://secunia.com/advisories/38517 http://ubuntu.com/usn/usn-897-1 http://www.debian.org/security/2008/dsa-1662 http://secunia.com/advisories/32578 http://www.ubuntu.com/usn/USN-671-1 http://secunia.com/advisories/32769 https://exchange.xforce.ibmcloud.com/vulnerabilities/45649 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10591 http://www.ubuntu.com/usn/USN-1397-1 https://access.redhat.com/errata/RHSA-2010:0109 https://nvd.nist.gov https://usn.ubuntu.com/671-1/https://www.debian.org/security/./dsa-1662

CVE-2008-4098

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect