MySQL 5.1.x before 5.1.23 and 6.0.x before 6.0.4 allows remote authenticated users to gain privileges on arbitrary tables via unspecified vectors involving use of table-level DATA DIRECTORY and INDEX DIRECTORY options when creating a partitioned table with the same name as a table on which the user lacks privileges.

The version of MySQL Server installed on the remote host reportedly is affected by the following issues :

 - It is possible, by creating a partitioned table using the DATA DIRECTORY and INDEX DIRECTORY options, to gain privileges on other tables having the same name as the partitioned table. (Bug #32091)

 - Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information. (Bug #32111).

 - ALTER VIEW retains the original DEFINER value, even when altered by another user, which can allow that user to gain the access rights of the view. (Bug #29908)

 - When using a FEDERATED table, the local server can be forced to crash if the remote server returns a result with fewer columns than expected. (Bug #29801)

The version of MySQL Server installed on the remote host reportedly is affected by the following issues :

  - It is possible, by creating a partitioned table using     the DATA DIRECTORY and INDEX DIRECTORY options, to gain     privileges on other tables having the same name as the     partitioned table. (Bug #32091)

  - Using RENAME TABLE against a table with explicit DATA     DIRECTORY and INDEX DIRECTORY options can be used to     overwrite system table information. (Bug #32111).

  - ALTER VIEW retains the original DEFINER value, even     when altered by another user, which can allow that     user to gain the access rights of the view. (Bug     #29908)

  - When using a FEDERATED table, the local server can be     forced to crash if the remote server returns a result     with fewer columns than expected. (Bug #29801)

ID	Name	Product	Family	Severity
4313	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
29345	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Nessus	Databases	medium
801147	MySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities	Log Correlation Engine	Database	medium

Detections

Analytics

CVE-2007-5970

high

Tenable Plugins

medium

medium

medium