sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink.

The remote Solaris system is missing necessary patches to address security updates :

  - MySQL before 5.0.67 allows local users to bypass certain     privilege checks by calling CREATE TABLE on a MyISAM     table with modified (1) DATA DIRECTORY or (2) INDEX     DIRECTORY arguments that are originally associated with     pathnames without symlinks, and that can point to tables     created at a future time at which a pathname is modified     to contain a symlink to a subdirectory of the MySQL home     data directory. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2008-4097. (CVE-2008-4098)

  - sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x     through 5.1.41, and 6.0 before 6.0.9-alpha, when the     data home directory contains a symlink to a different     filesystem, allows remote authenticated users to bypass     intended access restrictions by calling CREATE TABLE     with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY     argument referring to a subdirectory that requires     following this symlink. (CVE-2008-7247)

  - MySQL before 5.1.46 allows local users to delete the     data and index files of another user's MyISAM table via     a symlink attack in conjunction with the DROP TABLE     command, a different vulnerability than CVE-2008-4098     and CVE-2008-7247. (CVE-2010-1626)

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x     before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL     5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and     earlier allows remote attackers to cause a denial of     service (crash) via a crafted geometry feature that     specifies a large number of points, which is not     properly handled when processing the binary     representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL installed on the remote host is older than 6.0.9-alpha / 5.5.3.  As such, it reportedly allows a remote attacker to bypass access restrictions when the data directory contains a symbolic link to a different file system.

The remote host is affected by the vulnerability described in GLSA-201201-02 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MySQL. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may be able to execute arbitrary code       with the privileges of the MySQL process, cause a Denial of Service       condition, bypass security restrictions, uninstall arbitrary MySQL       plugins, or conduct Man-in-the-Middle and Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

Updated MySQL packages fix the following bugs :

  - upstream #47320 - checking server certificates.
    (CVE-2009-4028)

  - upstream #48291 - error handling in subqueries.
    (CVE-2009-4019)

  - upstream #47780 - preserving null_value flag in     GeomFromWKB(). (CVE-2009-4019)

  - upstream #39277 - symlink behaviour fixed.
    (CVE-2008-7247)

  - upstream #32167 - symlink behaviour refixed     (CVE-2009-4030)

The following bugs have been fixed :

  - local users could delete data files for tables of other     users. (CVE-2010-1626)

  - authenticated users could gather information for tables     they should not have access to. (CVE-2010-1849)

  - authenticated users could crash mysqld. (CVE-2010-3683,     CVE-2010-3681, CVE-2010-1848)

  - authenticated users could bypass intended access     restrictions. (CVE-2008-7247, CVE-2009-4030)

This update fixes various security issues (bnc#557669) :

upstream #47320 - checking server certificates (CVE-2009-4028) upstream #48291 - error handling in subqueries (CVE-2009-4019) upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) upstream #39277 - symlink behaviour fixed (CVE-2008-7247) upstream #32167 - symlink behaviour refixed (CVE-2009-4030) fixing remote buffer overflow. (CVE-2009-4484)

A vulnerability has been found and corrected in mysql :

MySQL is vulnerable to a symbolic link attack when the data home directory contains a symlink to a different filesystem which allows remote authenticated users to bypass intended access restrictions (CVE-2008-7247).

The updated packages have been patched to correct these issues.

Add backported patch for CVE-2008-7247 Use non-expired certificates for SSL testing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated mysql packages fix the following bugs :

  - upstream #47320 - checking server certificates     (CVE-2009-4028)

  - upstream #48291 - error handling in subqueries     (CVE-2009-4019)

  - upstream #47780 - preserving null_value flag in     GeomFromWKB() (CVE-2009-4019)

  - upstream #39277 - symlink behaviour fixed     (CVE-2008-7247)

  - upstream #32167 - symlink behaviour refixed     (CVE-2009-4030)

This update fixes several security issues in mysql :

  - checking server certificates (CVE-2009-4028)

  - error handling in subqueries (CVE-2009-4019)

  - preserving null_value flag in GeomFromWKB     (CVE-2009-4019)

  - symlink behavior fixed (CVE-2008-7247)

  - symlink behavior refixed (CVE-2009-4030)

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.3.  Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server

  - Apache

  - CoreAudio

  - CoreMedia

  - CoreTypes

  - CUPS

  - DesktopServices

  - Disk Images

  - Directory Services

  - Dovecot

  - Event Monitor

  - FreeRADIUS

  - FTP Server

  - iChat Server

  - ImageIO

  - Image RAW

  - Libsystem

  - Mail

  - MySQL

  - OS Services

  - Password Server

  - PHP

  - Podcast Producer

  - Preferences

  - PS Normalizer

  - QuickTime

  - Ruby

  - Server Admin

  - SMB

  - Tomcat

  - Wiki Server

  - X11

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

It was discovered that MySQL could be made to overwrite existing table files in the data directory. An authenticated user could use the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks. This update alters table creation behaviour by disallowing the use of the MySQL data directory in DATA DIRECTORY and INDEX DIRECTORY options. This issue only affected Ubuntu 8.10. (CVE-2008-4098) 

It was discovered that MySQL contained a cross-site scripting vulnerability in the command-line client when the --html option is enabled. An attacker could place arbitrary web script or html in a database cell, which would then get placed in the html document output by the command-line tool. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04. (CVE-2008-4456)

It was discovered that MySQL could be made to overwrite existing table files in the data directory. An authenticated user could use symlinks combined with the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks. This issue only affected Ubuntu 9.10. (CVE-2008-7247)

It was discovered that MySQL contained multiple format string flaws when logging database creation and deletion. An authenticated user could use specially crafted database names to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04. (CVE-2009-2446)

It was discovered that MySQL incorrectly handled errors when performing certain SELECT statements, and did not preserve correct flags when performing statements that use the GeomFromWKB function. An authenticated user could exploit this to make MySQL crash, causing a denial of service. (CVE-2009-4019)

It was discovered that MySQL incorrectly checked symlinks when using the DATA DIRECTORY and INDEX DIRECTORY options. A local user could use symlinks to create tables that pointed to tables known to be created at a later time, bypassing access restrictions. (CVE-2009-4030)

It was discovered that MySQL contained a buffer overflow when parsing ssl certificates. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 LTS and the default compiler options for affected releases should reduce the vulnerability to a denial of service. In the default installation, attackers would also be isolated by the AppArmor MySQL profile. (CVE-2009-4484).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL 6.0 installed on the remote host is earlier than 6.0.9, and thus potentially affected by a security bypass vulnerability.  The application allwos an attacker to bypass certain checks when creating a table with ceratin 'DATA DIRECTORY' and 'INDEX DIRECTORY' options that are within the MySQL home data directory.

The version of MySQL 6.0 installed on the remote host is earlier than 6.0.9, and thus potentially affected by a security bypass vulnerability.  The application allows an attacker to bypass certain checks when creating a table with certain 'DATA DIRECTORY' and 'INDEX DIRECTORY' options that are within the MySQL home data directory.

The version of MySQL 5.1 installed on the remote host is earlier than 5.1.41 and is, therefore, potentially affected by the following vulnerabilities :

  - An incomplete fix was provided in 5.1.24 for     CVE-2008-2079, a symlink-related privilege     escalation issue. (Bug #39277)

  - MySQL clients linked against OpenSSL are vulnerable     to man-in-the-middle attacks. (Bug #47320)

  - The GeomFromWKB() function can be manipulated     to cause a denial of service. (Bug #47780)

  - Specially crafted SELECT statements containing sub-     queries in the WHERE clause can cause the server     to crash. (Bug #48291)

The version of MySQL 5.0 installed on the remote host is earlier than 5.0.88. It is, therefore, potentially affected by the following vulnerabilities :

  - MySQL clients linked against OpenSSL are vulnerable     to man-in-the-middle attacks. (Bug #47320)

  - The GeomFromWKB() function can be manipulated     to cause a denial of service. (Bug #47780)

  - Specially crafted SELECT statements containing sub-     queries in the WHERE clause can cause the server     to crash. (Bug #48291)

  - It is possible to bypass access restrictions when the     data directory contains a symbolic link to a different     file system. (Bug #39277)

ID	Name	Product	Family	Severity
80705	Oracle Solaris Third-Party Patch Update : mysql (multiple_vulnerabilities_in_mysql)	Nessus	Solaris Local Security Checks	medium
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	high
17837	MySQL < 6.0.9-alpha / 5.5.3 Access Control Weakness	Nessus	Databases	medium
57446	GLSA-201201-02 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50935	SuSE 11 Security Update : MySQL (SAT Patch Number 2317)	Nessus	SuSE Local Security Checks	medium
50523	SuSE9 Security Update : MySQL (YOU Patch Number 12661)	Nessus	SuSE Local Security Checks	medium
49903	SuSE 10 Security Update : MySQL (ZYPP Patch Number 6899)	Nessus	SuSE Local Security Checks	high
48175	Mandriva Linux Security Advisory : mysql (MDVSA-2010:044)	Nessus	Mandriva Local Security Checks	medium
47248	Fedora 12 : mysql-5.1.42-7.fc12 (2010-1348)	Nessus	Fedora Local Security Checks	medium
47246	Fedora 11 : mysql-5.1.42-7.fc11 (2010-1300)	Nessus	Fedora Local Security Checks	medium
46235	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	medium
46232	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	medium
46229	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	medium
46220	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)	Nessus	SuSE Local Security Checks	medium
46219	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)	Nessus	SuSE Local Security Checks	medium
46218	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)	Nessus	SuSE Local Security Checks	medium
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
45107	SuSE 10 Security Update : MySQL (ZYPP Patch Number 6897)	Nessus	SuSE Local Security Checks	high
44585	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-897-1)	Nessus	Ubuntu Local Security Checks	high
801145	MySQL 6.0 < 6.0.9 CREATE TABLE Security Bypass	Log Correlation Engine	Database	medium
5333	Oracle MySQL 6.0 < 6.0.9 CREATE TABLE Security Bypass	Nessus Network Monitor	Database	medium
42900	MySQL 5.1 < 5.1.41 Multiple Vulnerabilities	Nessus	Databases	medium
42899	MySQL 5.0 < 5.0.88 Multiple Vulnerabilities	Nessus	Databases	medium

Detections

Analytics

CVE-2008-7247

high

Tenable Plugins

medium

high

medium

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

high

high

medium

medium

medium

medium