MySQL Control Center Insecure Default File Permission Vulnerability

Bugtraq ID:	7041
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Mar 07 2003 12:00AM
Updated:	Mar 07 2003 12:00AM
Credit:	This issue was reported in a Gentoo advisory.
Vulnerable:	MySQL AB Control Center 0.8.8
Not Vulnerable:	MySQL AB Control Center 0.8.10 MySQL AB Control Center 0.8.9

MySQL Control Center Insecure Default File Permission Vulnerability

A vulnerability has been discovered in MySQL Control Center 0.8.8 and earlier. The problem lies in the configuration and connection files that are installed world-readable. Access to these files by an untrustworthy local user may disclose information that could be used to launch further attacks against the system.

MySQL Control Center Insecure Default File Permission Vulnerability

No exploit is required.

MySQL Control Center Insecure Default File Permission Vulnerability

Solution:
It is recommended that all Gentoo Linux users who are running
dev-db/mysqlcc upgrade to mysqlcc-0.8.10-r1 as follows:

emerge sync
emerge -u mysqlcc
emerge clean

This issue has been addressed in MySQLCC 0.8.9 and later. Users are advised to upgrade to the latest MySQLCC release as soon as possible.


MySQL AB Control Center 0.8.8

• MySQL AB MySQL Control Center 0.8.10
  http://www.mysql.com/downloads/mysqlcc.html

MySQL Control Center Insecure Default File Permission Vulnerability

References:

• MySQL Control Center (MySQL AB)