MySQL Unspecified Insecure Temporary File Creation Vulnerability
BID:11291
Info
MySQL Unspecified Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 11291 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 30 2004 12:00AM |
| Updated: | Sep 30 2004 12:00AM |
| Credit: | The individual or individuals responsible for the discovery of this issue is currently unknown; Trustix security engineers are credited with these discoveries. |
| Vulnerable: |
MySQL AB MySQL 4.0.18 |
| Not Vulnerable: | |
Discussion
MySQL Unspecified Insecure Temporary File Creation Vulnerability
MySQL is affected by an unspecified insecure temporary file creation vulnerability. This issue is likely due to a design error that causes the application to fail to verify the existance of a file before writing to it.
An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application. Reportedly this issue is unlikely to facilitate privilege escalation.
MySQL is affected by an unspecified insecure temporary file creation vulnerability. This issue is likely due to a design error that causes the application to fail to verify the existance of a file before writing to it.
An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application. Reportedly this issue is unlikely to facilitate privilege escalation.
Exploit / POC
MySQL Unspecified Insecure Temporary File Creation Vulnerability
No exploit is required to leverage this issue.
No exploit is required to leverage this issue.
Solution / Fix
MySQL Unspecified Insecure Temporary File Creation Vulnerability
Solution:
Trustix Linux has released an advisory (TSL-2004-0050) along with fixes dealing with this issue. Please see the referenced advisory for more information.
MySQL AB MySQL 4.0.18
Solution:
Trustix Linux has released an advisory (TSL-2004-0050) along with fixes dealing with this issue. Please see the referenced advisory for more information.
MySQL AB MySQL 4.0.18
-
Trustix mysql-4.0.18-4tr.i586.rpm
Trustix Secure Linux 2.1 & Enterprise Server 2
ftp://ftp.trustix.org/pub/trustix/updates/ -
Trustix mysql-bench-4.0.18-4tr.i586.rpm
Trustix Secure Linux 2.1 & Enterprise Server 2
ftp://ftp.trustix.org/pub/trustix/updates/ -
Trustix mysql-client-4.0.18-4tr.i586.rpm
Trustix Secure Linux 2.1 & Enterprise Server 2
ftp://ftp.trustix.org/pub/trustix/updates/ -
Trustix mysql-devel-4.0.18-4tr.i586.rpm
Trustix Secure Linux 2.1 & Enterprise Server 2
ftp://ftp.trustix.org/pub/trustix/updates/ -
Trustix mysql-libs-4.0.18-4tr.i586.rpm
Trustix Secure Linux 2.1 & Enterprise Server 2
ftp://ftp.trustix.org/pub/trustix/updates/ -
Trustix mysql-shared-4.0.18-4tr.i586.rpm
Trustix Secure Linux 2.1 & Enterprise Server 2
ftp://ftp.trustix.org/pub/trustix/updates/
References
MySQL Unspecified Insecure Temporary File Creation Vulnerability
References:
References:
- MySQL Homepage (Oracle)