Description
MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://marc.info/?l=bugtraq&m=104800948128630&w=2 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A442 ↗
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000743 ↗
- http://marc.info/?l=bugtraq&m=104802285012750&w=2 ↗
- http://www.debian.org/security/2003/dsa-303 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/11510 ↗
- http://rhn.redhat.com/errata/RHSA-2003-094.html ↗
- http://www.mandriva.com/security/advisories?name=MDKSA-2003:057 ↗
- http://www.kb.cert.org/vuls/id/203897 ↗
- http://marc.info/?l=bugtraq&m=104739810523433&w=2 ↗
- http://www.linuxsecurity.com/advisories/engarde_advisory-3046.html ↗
- http://www.redhat.com/support/errata/RHSA-2003-093.html ↗
- http://www.securityfocus.com/bid/7052 ↗
- http://marc.info/?l=bugtraq&m=104715840202315&w=2 ↗