MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of a CVE-2009-4030 regression, which was not omitted in other packages and versions such as MySQL 5.0.95 in Red Hat Enterprise Linux 6.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0121 advisory.

    - Re-add patch for CVE-2009-4030, mistakenly removed in 5.0.95 rebase     Resolves: CVE-2012-4452

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was found that the fix for the CVE-2009-4030 issue, a flaw in the way MySQL checked the paths used as arguments for the DATA DIRECTORY and INDEX DIRECTORY directives when the 'datadir' option was configured with a relative path, was incorrectly removed when the mysql packages in Scientific Linux 5 were updated to version 5.0.95 via SLSA-2012:0127. An authenticated attacker could use this flaw to bypass the restriction preventing the use of subdirectories of the MySQL data directory being used as DATA DIRECTORY and INDEX DIRECTORY paths. This update re-applies the fix for CVE-2009-4030.
(CVE-2012-4452)

Note: If the use of the DATA DIRECTORY and INDEX DIRECTORY directives were disabled as described in SLSA-2010:0109 (by adding 'symbolic-links=0' to the '[mysqld]' section of the 'my.cnf' configuration file), users were not vulnerable to this issue.

This update also fixes the following bugs :

  - Prior to this update, the log file path in the logrotate     script did not behave as expected. As a consequence, the     logrotate function failed to rotate the     '/var/log/mysqld.log' file. This update modifies the     logrotate script to allow rotating the mysqld.log file.

  - Prior to this update, the mysqld daemon could fail when     using the EXPLAIN flag in prepared statement mode. This     update modifies the underlying code to handle the     EXPLAIN flag as expected.

  - Prior to this update, the mysqld init script could     wrongly report that mysql server startup failed when the     server was actually started. This update modifies the     init script to report the status of the mysqld server as     expected.

  - Prior to this update, the '--enable-profiling' option     was by default disabled. This update enables the     profiling feature.

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

Updated mysql packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

It was found that the fix for the CVE-2009-4030 issue, a flaw in the way MySQL checked the paths used as arguments for the DATA DIRECTORY and INDEX DIRECTORY directives when the 'datadir' option was configured with a relative path, was incorrectly removed when the mysql packages in Red Hat Enterprise Linux 5 were updated to version 5.0.95 via RHSA-2012:0127. An authenticated attacker could use this flaw to bypass the restriction preventing the use of subdirectories of the MySQL data directory being used as DATA DIRECTORY and INDEX DIRECTORY paths. This update re-applies the fix for CVE-2009-4030.
(CVE-2012-4452)

Note: If the use of the DATA DIRECTORY and INDEX DIRECTORY directives were disabled as described in RHSA-2010:0109 (by adding 'symbolic-links=0' to the '[mysqld]' section of the 'my.cnf' configuration file), users were not vulnerable to this issue.

This issue was discovered by Karel Volny of the Red Hat Quality Engineering team.

This update also fixes the following bugs :

* Prior to this update, the log file path in the logrotate script did not behave as expected. As a consequence, the logrotate function failed to rotate the '/var/log/mysqld.log' file. This update modifies the logrotate script to allow rotating the mysqld.log file.
(BZ#647223)

* Prior to this update, the mysqld daemon could fail when using the EXPLAIN flag in prepared statement mode. This update modifies the underlying code to handle the EXPLAIN flag as expected. (BZ#654000)

* Prior to this update, the mysqld init script could wrongly report that mysql server startup failed when the server was actually started.
This update modifies the init script to report the status of the mysqld server as expected. (BZ#703476)

* Prior to this update, the '--enable-profiling' option was by default disabled. This update enables the profiling feature. (BZ#806365)

All MySQL users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The version of MySQL installed may be affected by a symlink-related restriction bypass vulnerability due to a CVE-2009-4030 regression fix being removed in a RedHat 5.0.95 package. 

Note that this flaw has no impact if the default basedir and datadir configuration values are unchanged.

The version of MySQL 5.0 installed on the remote host is earlier than 5.0.88. It is, therefore, potentially affected by the following vulnerabilities :

  - MySQL clients linked against OpenSSL are vulnerable     to man-in-the-middle attacks. (Bug #47320)

  - The GeomFromWKB() function can be manipulated     to cause a denial of service. (Bug #47780)

  - Specially crafted SELECT statements containing sub-     queries in the WHERE clause can cause the server     to crash. (Bug #48291)

  - It is possible to bypass access restrictions when the     data directory contains a symbolic link to a different     file system. (Bug #39277)

ID	Name	Product	Family	Severity
68692	Oracle Linux 5 : mysql (ELSA-2013-0121)	Nessus	Oracle Linux Local Security Checks	high
63599	Scientific Linux Security Update : mysql on SL5.x i386/x86_64 (20130108)	Nessus	Scientific Linux Local Security Checks	medium
63566	CentOS 5 : mysql (CESA-2013:0121)	Nessus	CentOS Local Security Checks	low
63404	RHEL 5 : mysql (RHSA-2013:0121)	Nessus	Red Hat Local Security Checks	low
62927	MySQL 5.0.95 MyISAM Table Symbolic Link Local Restriction Bypass	Nessus	Databases	medium
42899	MySQL 5.0 < 5.0.88 Multiple Vulnerabilities	Nessus	Databases	medium

Detections

Analytics

CVE-2012-4452

high

Tenable Plugins

high

medium

low

low

medium

medium