CVE-2009-4030
published 2009-11-30CVE-2009-4030: MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or…
PriorityP414medium4.4CVSS 2.0
AVLACMAuNCPIPAP
EPSS
0.43%
34.8th percentile
MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| mysql | mysql | — | — |
| oracle | mysql | <= 5.0.88 | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
| oracle | mysql | — | — |
CVSS provenance
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat4.6MEDIUM
vendor_ubuntu4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-552j-94gg-c5pj: MySQL 5
ghsa_unreviewed·2022-05-17·CVSS 4.4
CVE-2012-4452 [MEDIUM] GHSA-552j-94gg-c5pj: MySQL 5
MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of a CVE-2009-4030 regression, which was not omitted in other packages and versions such as MySQL 5.0.95 in Red Hat Enterprise Linux 6.
GHSA
GHSA-q8q6-rcmj-g45q: MySQL 5
ghsa_unreviewed·2022-05-02·CVSS 4.6
CVE-2009-4030 [MEDIUM] CWE-59 GHSA-q8q6-rcmj-g45q: MySQL 5
MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
Red Hat
mysql: regression of CVE-2009-4030
vendor_redhat·2012-09-27·CVSS 4.4
CVE-2012-4452 [MEDIUM] mysql: regression of CVE-2009-4030
mysql: regression of CVE-2009-4030
MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of a CVE-2009-4030 regression, which was not omitted in other packages and versions such as MySQL 5.0.95 in Red Hat Enterprise Linux 6.
Package: mysql (Red Hat Enterprise Linux 6) - Not affected
Ubuntu
MySQL vulnerabilities
vendor_ubuntu·2012-03-12
CVE-2007-5925 MySQL vulnerabilities
Title: MySQL vulnerabilities
Summary: Several security issues were fixed in MySQL.
Multiple security issues were discovered in MySQL and this update includes
new upstream MySQL versions to fix these issues.
MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10,
Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to
MySQL 5.0.95.
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html
http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
MySQL vulnerabilities
vendor_ubuntu·2010-02-10·CVSS 4.6
CVE-2008-7247 [MEDIUM] MySQL vulnerabilities
Title: MySQL vulnerabilities
Summary: MySQL vulnerabilities
It was discovered that MySQL could be made to overwrite existing table
files in the data directory. An authenticated user could use the DATA
DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks.
This update alters table creation behaviour by disallowing the use of the
MySQL data directory in DATA DIRECTORY and INDEX DIRECTORY options. This
issue only affected Ubuntu 8.10. (CVE-2008-4098)
It was discovered that MySQL contained a cross-site scripting vulnerability
in the command-line client when the --html option is enabled. An attacker
could place arbitrary web script or html in a database cell, which would
then get placed in the html document output by the command-line tool. This
issue only affected Ubuntu
Red Hat
mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
vendor_redhat·2009-11-04·CVSS 4.6
CVE-2009-4030 [MEDIUM] mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-4452 mysql: regression of CVE-2009-4030
bugzilla·2012-09-26·CVSS 4.4
CVE-2012-4452 [MEDIUM] CVE-2012-4452 mysql: regression of CVE-2009-4030
CVE-2012-4452 mysql: regression of CVE-2009-4030
It was found that the fix for CVE-2009-4030 was removed from the MySQL packages as provided with RHSA-2012:0127 when it was updated to version 5.0.95. Upstream claimed to have corrected this in version 5.0.88, so the patch was removed when it did not apply. As a result, MySQL version 5.0.95-1.el5_7.1 became vulnerable to CVE-2009-4030 again.
For most default or typical configurations, this flaw has no impact. Please see https://bugzilla.redhat.com/show_bug.cgi?id=543653#c4 for further discussion on the possible scenarios where this flaw can be triggered. If the basedir and datadir directives are unchanged in MySQL's configuration or command-line arguments, this flaw has no impact.
Discussion:
Statement:
(none)
---
Acknowledgements:
T
Bugzilla
CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
bugzilla·2009-12-02·CVSS 4.6
CVE-2009-4030 [MEDIUM] CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4030 to
the following vulnerability:
MySQL 5.1.x before 5.1.41 allows local users to bypass certain
privilege checks by calling CREATE TABLE on a MyISAM table with
modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are
originally associated with pathnames without symlinks, and that can
point to tables created at a future time at which a pathname is
modified to contain a symlink to a subdirectory of the MySQL data home
directory, related to incorrect calculation of the
mysql_unpacked_real_data_home value. NOTE: this vulnerability exists
because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
References:
http://lists.mysql.com/
http://bugs.mysql.com/bug.php?id=32167http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.htmlhttp://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlhttp://lists.mysql.com/commits/89940http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.htmlhttp://marc.info/?l=oss-security&m=125908040022018&w=2http://marc.info/?l=oss-security&m=125908080222685&w=2http://secunia.com/advisories/38517http://secunia.com/advisories/38573http://support.apple.com/kb/HT4077http://ubuntu.com/usn/usn-897-1http://www.debian.org/security/2010/dsa-1997http://www.openwall.com/lists/oss-security/2009/11/19/3http://www.openwall.com/lists/oss-security/2009/11/24/6http://www.redhat.com/support/errata/RHSA-2010-0109.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0110.htmlhttp://www.ubuntu.com/usn/USN-1397-1http://www.vupen.com/english/advisories/2010/1107https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11116https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8156http://bugs.mysql.com/bug.php?id=32167http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.htmlhttp://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlhttp://lists.mysql.com/commits/89940http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.htmlhttp://marc.info/?l=oss-security&m=125908040022018&w=2http://marc.info/?l=oss-security&m=125908080222685&w=2http://secunia.com/advisories/38517http://secunia.com/advisories/38573http://support.apple.com/kb/HT4077http://ubuntu.com/usn/usn-897-1http://www.debian.org/security/2010/dsa-1997http://www.openwall.com/lists/oss-security/2009/11/19/3http://www.openwall.com/lists/oss-security/2009/11/24/6http://www.redhat.com/support/errata/RHSA-2010-0109.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0110.htmlhttp://www.ubuntu.com/usn/USN-1397-1http://www.vupen.com/english/advisories/2010/1107https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11116https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8156
2009-11-30
Published