Published: 13/07/2010 Updated: 09/11/2020

CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8

VMScore: 355

Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P

MySQL prior to 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle mysql
canonical ubuntu linux 6.06
canonical ubuntu linux 8.04
canonical ubuntu linux 9.10
canonical ubuntu linux 10.04
canonical ubuntu linux 10.10
canonical ubuntu linux 11.04
canonical ubuntu linux 11.10
fedoraproject fedora 13

Several security issues were fixed in MySQL ...

It was discovered that MySQL incorrectly handled certain requests with the UPGRADE DATA DIRECTORY NAME command An authenticated user could exploit this to make MySQL crash, causing a denial of service This issue only affected Ubuntu 910 and 1004 LTS (CVE-2010-2008) ...

A vulnerability was reported in MySQL A remote authenticated user can cause denial of service conditions This issue affects versions prior to MySQL 5148 A remote authenticated user can send a specially crafted ALTER DATABASE command to cause the target server to move a data directory into a new subdirectory, causing the data directory to be ...

CWE-77 http://bugs.mysql.com/bug.php?id=53804 http://dev.mysql.com/doc/refman/5.1/en/news-5-1-48.html http://www.securityfocus.com/bid/41198 http://www.securitytracker.com/id?1024160 http://secunia.com/advisories/40333 http://secunia.com/advisories/40762 http://www.vupen.com/english/advisories/2010/1918 http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044546.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:155 http://www.ubuntu.com/usn/USN-1017-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11869 http://www.ubuntu.com/usn/USN-1397-1 https://nvd.nist.gov https://usn.ubuntu.com/1397-1/https://www.exploit-db.com/exploits/14537/

CVE-2010-2008

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect