CVE-2008-2079
published 2008-05-05CVE-2008-2079: MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling…
PriorityP419medium4.6CVSS 2.0
AVNACHAuSCPIPAP
EPSS
2.59%
83.5th percentile
MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | >= 4.1.0 < 4.1.24 | 4.1.24 |
| mysql | mysql | >= 5.0.0 < 5.0.60 | 5.0.60 |
| mysql | mysql | >= 5.1.0 < 5.1.24 | 5.1.24 |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
CVSS provenance
nvdv2.04.6MEDIUMAV:N/AC:H/Au:S/C:P/I:P/A:P
vendor_redhat4.6MEDIUM
vendor_ubuntu4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
vendor_redhat·2009-11-04·CVSS 4.6
CVE-2009-4030 [MEDIUM] mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
Ubuntu
MySQL vulnerabilities
vendor_ubuntu·2008-11-17·CVSS 4.6
CVE-2008-2079 [MEDIUM] MySQL vulnerabilities
Title: MySQL vulnerabilities
Summary: MySQL vulnerabilities
It was discovered that MySQL could be made to overwrite existing table
files in the data directory. An authenticated user could use the
DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege
checks. This update alters table creation behaviour by disallowing the
use of the MySQL data directory in DATA DIRECTORY and INDEX DIRECTORY
options. (CVE-2008-2079, CVE-2008-4097 and CVE-2008-4098)
It was discovered that MySQL did not handle empty bit-string literals
properly. An attacker could exploit this problem and cause the MySQL
server to crash, leading to a denial of service. (CVE-2008-3963)
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
mysql: incomplete upstream fix for CVE-2008-2079
vendor_redhat·2008-07-03·CVSS 4.6
CVE-2008-4098 [MEDIUM] mysql: incomplete upstream fix for CVE-2008-2079
mysql: incomplete upstream fix for CVE-2008-2079
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
Statement: In Red Hat Enterprise Linux 5, issue CVE-2008-2079 was fixed without introducing CVE-2008-4098 in RHSA-2009:1289.
Red Hat
mysql: privilege escalation via DATA/INDEX DIRECTORY directives
vendor_redhat·2008-03-13·CVSS 4.6
CVE-2008-2079 [MEDIUM] mysql: privilege escalation via DATA/INDEX DIRECTORY directives
mysql: privilege escalation via DATA/INDEX DIRECTORY directives
MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future.
Statement: This issue did not affect MySQL as supplied with Red Hat Enterprise Linux 3.
Red Hat
CVE-2008-4097: MySQL 5
vendor_redhat·CVSS 4.6
CVE-2008-4097 [MEDIUM] CVE-2008-4097: MySQL 5
MySQL 5.0.51a allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are associated with symlinks within pathnames for subdirectories of the MySQL home data directory, which are followed when tables are created in the future. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-2079.
Statement: Not vulnerable. This issue did not affect the versions of MySQL as shipped with any Red Hat product as the improper fix for CVE-2008-2097 that led to the issuance of this CVE was never used.
GHSA
GHSA-q8q6-rcmj-g45q: MySQL 5
ghsa_unreviewed·2022-05-02·CVSS 4.6
CVE-2009-4030 [MEDIUM] CWE-59 GHSA-q8q6-rcmj-g45q: MySQL 5
MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
GHSA
GHSA-rxrr-c7mj-hq68: MySQL 5
ghsa_unreviewed·2022-05-02·CVSS 4.6
CVE-2008-4097 [MEDIUM] GHSA-rxrr-c7mj-hq68: MySQL 5
MySQL 5.0.51a allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are associated with symlinks within pathnames for subdirectories of the MySQL home data directory, which are followed when tables are created in the future. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-2079.
GHSA
GHSA-789p-mwwq-w5cp: MySQL 4
ghsa_unreviewed·2022-05-01
CVE-2008-2079 [MEDIUM] GHSA-789p-mwwq-w5cp: MySQL 4
MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-1626 mysql: table destruction via DATA/INDEX DIRECTORY directives using symlinks
bugzilla·2010-01-08·CVSS 4.6
CVE-2010-1626 [MEDIUM] CVE-2010-1626 mysql: table destruction via DATA/INDEX DIRECTORY directives using symlinks
CVE-2010-1626 mysql: table destruction via DATA/INDEX DIRECTORY directives using symlinks
Ingo Strüwing reported another problem related to CVE-2008-2079 / CVE-2008-4098. A user with with privileges to CREATE / DROP tables in some MySQL database with shell access to the database server can remove data file for other tables using MyISAM storage engine, even in different databases.
Issue was first mentioned in upstream bug:
http://bugs.mysql.com/bug.php?id=39277
http://bugs.mysql.com/file.php?id=10707&text=1
Issue is tracked upstream via (previously public, but currently restricted) bug:
http://bugs.mysql.com/bug.php?id=40980
Problem has not upstream fix yet.
More details can be found in:
https://bugzilla.redhat.com/show_bug.cgi?id=543619#c4
Discussion:
Mitigation:
Disable use of tabl
Bugzilla
CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
bugzilla·2009-12-02·CVSS 4.6
CVE-2009-4030 [MEDIUM] CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4030 to
the following vulnerability:
MySQL 5.1.x before 5.1.41 allows local users to bypass certain
privilege checks by calling CREATE TABLE on a MyISAM table with
modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are
originally associated with pathnames without symlinks, and that can
point to tables created at a future time at which a pathname is
modified to contain a symlink to a subdirectory of the MySQL data home
directory, related to incorrect calculation of the
mysql_unpacked_real_data_home value. NOTE: this vulnerability exists
because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
References:
http://lists.mysql.com/
Bugzilla
CVE-2008-4098 mysql: incomplete upstream fix for CVE-2008-2079
bugzilla·2008-07-04·CVSS 4.6
CVE-2008-4098 [MEDIUM] CVE-2008-4098 mysql: incomplete upstream fix for CVE-2008-2079
CVE-2008-4098 mysql: incomplete upstream fix for CVE-2008-2079
Devin Carraway of the Debian Security Team discovered that the upstream fix for
the CVE-2008-2079 is incomplete and still makes it possible for local users to
create tables via INDEX/DATA DIRECTORY directives in the MySQL data directory
(/var/lib/mysql) via directory symlinks.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25
CVE-2008-2079 was tracked via bug bug #445222.
An attacker needs following to exploit this issue:
- MySQL database account with privileges to create tables
- shell access to the host running MySQL database with write access to a
directory accessible by the mysqld daemon process
Discussion:
Note: this attack does not work on existing tables. An attacker can only elevate
their access to anothe
Bugzilla
CVE-2008-2079 mysql: privilege escalation via DATA/INDEX DIRECTORY directives
bugzilla·2008-05-05·CVSS 4.6
CVE-2008-2079 [MEDIUM] CVE-2008-2079 mysql: privilege escalation via DATA/INDEX DIRECTORY directives
CVE-2008-2079 mysql: privilege escalation via DATA/INDEX DIRECTORY directives
MySQL 4.1.24, 5.0.60, 5.1.24, and 6.0.5 fixes an issue allowing an authenticated
attacker to gain privileges to tables that will be created by some other
database user in future using MyISAM storage engine, if an attacker can predict
names of such tables.
Attacker can create a table using DATA/INDEX DIRECTORY directives causing data
and index files (.MYD/.MYI) to be created in some other directory writable by
mysql server, including directories used to store table files of other users'
databases. If victim later creates table with the same name, attacker's data
and index files are overwritten by victim's files, but access privileges are not
revoked. Attacker gains access to newly created victim's table.
Refere
http://bugs.mysql.com/bug.php?id=32167http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.htmlhttp://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-60.htmlhttp://dev.mysql.com/doc/refman/5.1/en/news-5-1-24.htmlhttp://dev.mysql.com/doc/refman/6.0/en/news-6-0-5.htmlhttp://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2009/Sep/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.htmlhttp://secunia.com/advisories/30134http://secunia.com/advisories/31066http://secunia.com/advisories/31226http://secunia.com/advisories/31687http://secunia.com/advisories/32222http://secunia.com/advisories/32769http://secunia.com/advisories/36566http://secunia.com/advisories/36701http://support.apple.com/kb/HT3216http://support.apple.com/kb/HT3865http://www.debian.org/security/2008/dsa-1608http://www.mandriva.com/security/advisories?name=MDVSA-2008:149http://www.mandriva.com/security/advisories?name=MDVSA-2008:150http://www.redhat.com/support/errata/RHSA-2008-0505.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0510.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0768.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1289.htmlhttp://www.securityfocus.com/bid/29106http://www.securityfocus.com/bid/31681http://www.securitytracker.com/id?1019995http://www.ubuntu.com/usn/USN-671-1http://www.vupen.com/english/advisories/2008/1472/referenceshttp://www.vupen.com/english/advisories/2008/2780https://exchange.xforce.ibmcloud.com/vulnerabilities/42267https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10133http://bugs.mysql.com/bug.php?id=32167http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.htmlhttp://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-60.htmlhttp://dev.mysql.com/doc/refman/5.1/en/news-5-1-24.htmlhttp://dev.mysql.com/doc/refman/6.0/en/news-6-0-5.htmlhttp://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2009/Sep/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.htmlhttp://secunia.com/advisories/30134http://secunia.com/advisories/31066http://secunia.com/advisories/31226http://secunia.com/advisories/31687http://secunia.com/advisories/32222http://secunia.com/advisories/32769http://secunia.com/advisories/36566http://secunia.com/advisories/36701http://support.apple.com/kb/HT3216http://support.apple.com/kb/HT3865http://www.debian.org/security/2008/dsa-1608http://www.mandriva.com/security/advisories?name=MDVSA-2008:149http://www.mandriva.com/security/advisories?name=MDVSA-2008:150http://www.redhat.com/support/errata/RHSA-2008-0505.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0510.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0768.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1289.htmlhttp://www.securityfocus.com/bid/29106http://www.securityfocus.com/bid/31681http://www.securitytracker.com/id?1019995http://www.ubuntu.com/usn/USN-671-1http://www.vupen.com/english/advisories/2008/1472/referenceshttp://www.vupen.com/english/advisories/2008/2780https://exchange.xforce.ibmcloud.com/vulnerabilities/42267https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10133
2008-05-05
Published