MySQL Server Privilege Escalation And Denial Of Service Vulnerabilities
BID:26832
Info
MySQL Server Privilege Escalation And Denial Of Service Vulnerabilities
| Bugtraq ID: | 26832 |
| Class: | Design Error |
| CVE: |
CVE-2007-6303 CVE-2007-6304 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Nov 30 2007 12:00AM |
| Updated: | Apr 13 2015 10:24PM |
| Credit: | Philip Stoev and Martin Friebe disclosed these issues. |
| Vulnerable: |
Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise SDK 10 SP1 SuSE Suse Linux Enterprise Desktop 10 SP1 SuSE Linux Desktop 1.0 SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc SuSE Linux 10.0 x86-64 SuSE Linux 10.0 x86 SuSE Linux 10.0 ppc S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9.0 rPath rPath Linux 1 Redhat Fedora 7 MySQL AB MySQL 6.0.3 MySQL AB MySQL 6.0.2 MySQL AB MySQL 6.0.1 MySQL AB MySQL 6.0 MySQL AB MySQL 5.1.22 MySQL AB MySQL 5.1.18 MySQL AB MySQL 5.1.17 MySQL AB MySQL 5.1.16 MySQL AB MySQL 5.1.15 MySQL AB MySQL 5.1.14 MySQL AB MySQL 5.1.13 MySQL AB MySQL 5.1.12 MySQL AB MySQL 5.1.11 MySQL AB MySQL 5.1.10 MySQL AB MySQL 5.0.51 MySQL AB MySQL 5.0.50 MySQL AB MySQL 5.0.49 MySQL AB MySQL 5.0.48 MySQL AB MySQL 5.0.47 MySQL AB MySQL 5.0.46 MySQL AB MySQL 5.0.45 MySQL AB MySQL 5.0.44 MySQL AB MySQL 5.0.42 MySQL AB MySQL 5.0.40 MySQL AB MySQL 5.0.39 MySQL AB MySQL 5.0.38 MySQL AB MySQL 5.0.37 MySQL AB MySQL 5.0.36 MySQL AB MySQL 5.0.33 MySQL AB MySQL 5.0.32 MySQL AB MySQL 5.0.27 MySQL AB MySQL 5.0.24 MySQL AB MySQL 5.0.22 -1-0.1 MySQL AB MySQL 5.0.22 MySQL AB MySQL 5.0.21 MySQL AB MySQL 5.0.20 MySQL AB MySQL 5.0.19 MySQL AB MySQL 5.0.18 MySQL AB MySQL 5.0.4 MySQL AB MySQL 5.0.3 MySQL AB MySQL 5.0.2 MySQL AB MySQL 5.0.1 MySQL AB MySQL 5.0 .0-alpha MySQL AB MySQL 5.0 .0-0 MySQL AB MySQL 4.1.23 MySQL AB MySQL 4.1.21 MySQL AB MySQL 4.1.20 MySQL AB MySQL 4.1.19 MySQL AB MySQL 4.1.18 MySQL AB MySQL 4.1.16 MySQL AB MySQL 4.1.15 MySQL AB MySQL 4.1.13 MySQL AB MySQL 4.1.12 MySQL AB MySQL 4.1.11 MySQL AB MySQL 4.1.7 MySQL AB MySQL 4.1.5 MySQL AB MySQL 4.1.4 MySQL AB MySQL 4.1.3 -beta MySQL AB MySQL 4.1.3 -0 MySQL AB MySQL 4.1.2 -alpha MySQL AB MySQL 4.1.2 MySQL AB MySQL 4.1.1 MySQL AB MySQL 4.1 .11 MySQL AB MySQL 4.0.27 MySQL AB MySQL 4.0.26 MySQL AB MySQL 4.0.25 MySQL AB MySQL 4.0.24 MySQL AB MySQL 4.0.23 MySQL AB MySQL 4.0.21 MySQL AB MySQL 4.0.20 MySQL AB MySQL 4.0.19 MySQL AB MySQL 4.0.18 MySQL AB MySQL 4.0.17 MySQL AB MySQL 4.0.15 MySQL AB MySQL 4.0.14 MySQL AB MySQL 4.0.13 MySQL AB MySQL 4.0.12 MySQL AB MySQL 4.0.11 -gamma MySQL AB MySQL 4.0.11 MySQL AB MySQL 4.0.10 MySQL AB MySQL 4.0.9 -gamma MySQL AB MySQL 4.0.9 MySQL AB MySQL 4.0.8 -gamma MySQL AB MySQL 4.0.8 MySQL AB MySQL 4.0.7 -gamma MySQL AB MySQL 4.0.7 MySQL AB MySQL 4.0.6 MySQL AB MySQL 4.0.5 a MySQL AB MySQL 4.0.5 MySQL AB MySQL 4.0.4 MySQL AB MySQL 4.0.3 MySQL AB MySQL 4.0.2 MySQL AB MySQL 4.0.1 MySQL AB MySQL 4.0 .0 MySQL AB MySQL 3.23.59 MySQL AB MySQL 3.23.58 MySQL AB MySQL 3.23.56 MySQL AB MySQL 3.23.55 MySQL AB MySQL 3.23.54 a MySQL AB MySQL 3.23.54 MySQL AB MySQL 3.23.53 a MySQL AB MySQL 3.23.53 MySQL AB MySQL 3.23.52 MySQL AB MySQL 3.23.51 MySQL AB MySQL 3.23.50 MySQL AB MySQL 3.23.49 MySQL AB MySQL 3.23.48 MySQL AB MySQL 3.23.47 MySQL AB MySQL 3.23.46 MySQL AB MySQL 3.23.45 MySQL AB MySQL 3.23.44 MySQL AB MySQL 3.23.43 MySQL AB MySQL 3.23.42 MySQL AB MySQL 3.23.41 MySQL AB MySQL 3.23.40 MySQL AB MySQL 3.23.39 MySQL AB MySQL 3.23.38 MySQL AB MySQL 3.23.37 MySQL AB MySQL 3.23.36 MySQL AB MySQL 3.23.34 MySQL AB MySQL 3.23.33 MySQL AB MySQL 3.23.31 MySQL AB MySQL 3.23.30 MySQL AB MySQL 3.23.29 MySQL AB MySQL 3.23.28 gamma MySQL AB MySQL 3.23.28 MySQL AB MySQL 3.23.27 MySQL AB MySQL 3.23.26 MySQL AB MySQL 3.23.25 MySQL AB MySQL 3.23.24 MySQL AB MySQL 3.23.23 MySQL AB MySQL 3.23.22 MySQL AB MySQL 3.23.10 MySQL AB MySQL 3.23.9 MySQL AB MySQL 3.23.8 MySQL AB MySQL 3.23.5 MySQL AB MySQL 3.23.4 MySQL AB MySQL 3.23.3 MySQL AB MySQL 3.23.2 MySQL AB MySQL 3.23 .x MySQL AB MySQL 3.22.32 MySQL AB MySQL 3.22.30 MySQL AB MySQL 3.22.29 MySQL AB MySQL 3.22.28 MySQL AB MySQL 3.22.27 MySQL AB MySQL 3.22.26 MySQL AB MySQL 3.22.25 MySQL AB MySQL 3.22 .x MySQL AB MySQL 3.21 .x MySQL AB MySQL 3.20.32 a MySQL AB MySQL 3.20 .x MySQL AB MySQL 5.0 MySQL AB MySQL 4.1.11a MySQL AB MySQL 4.1.10a MySQL AB MySQL 4.1.0.0-alpha MySQL AB MySQL 4.1.0-0 Miva htmlscript 3.23.32 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 |
| Not Vulnerable: |
MySQL AB MySQL 6.0.4 MySQL AB MySQL 5.1.23 MySQL AB MySQL 5.0.52 |
Discussion
MySQL Server Privilege Escalation And Denial Of Service Vulnerabilities
MySQL is prone to multiple vulnerabilities, including privilege-escalation and denial-of-service issues.
Exploiting the privilege-escalation vulnerability may allow attackers to perform certain actions with elevated privileges. Successful exploits of the denial-of-service issue will cause the database server to crash, denying service to legitimate users.
These issues affect versions prior to MySQL 5.0.52, MySQL 5.1.23, and MySQL 6.0.4.
MySQL is prone to multiple vulnerabilities, including privilege-escalation and denial-of-service issues.
Exploiting the privilege-escalation vulnerability may allow attackers to perform certain actions with elevated privileges. Successful exploits of the denial-of-service issue will cause the database server to crash, denying service to legitimate users.
These issues affect versions prior to MySQL 5.0.52, MySQL 5.1.23, and MySQL 6.0.4.
Exploit / POC
MySQL Server Privilege Escalation And Denial Of Service Vulnerabilities
To exploit these issues, attackers can use standard database client software in conjunction with standard operating system utilities.
To exploit these issues, attackers can use standard database client software in conjunction with standard operating system utilities.
Solution / Fix
MySQL Server Privilege Escalation And Denial Of Service Vulnerabilities
Solution:
The vendor released updates to address these issues. Please see the references for more information.
Note that MySQL 6.0.4 and 5.1.23 have not been released yet.
Solution:
The vendor released updates to address these issues. Please see the references for more information.
Note that MySQL 6.0.4 and 5.1.23 have not been released yet.
References
MySQL Server Privilege Escalation And Denial Of Service Vulnerabilities
References:
References:
- Bug #29801 Federated engine crashes local server if remote server sends malicio (MySQL AB)
- Bug #29908 alter view keeps current definer, user can gain additioanl access (MySQL AB)
- Changes in MySQL 5.1.23 (MySQL AB)
- Changes in MySQL 6.0.4 (MySQL AB)
- MySQL Homepage (Oracle)
- Release Notes for MySQL 5.0.52 (MySQL AB)