CVE Vulnerabilities

CVE-2009-4030

Improper Link Resolution Before File Access ('Link Following')

Published: Nov 30, 2009 | Modified: Dec 17, 2019
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4.4 MEDIUM
AV:L/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
2.4 LOW
AV:L/AC:H/Au:S/C:N/I:P/A:P
RedHat/V3
Ubuntu

MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.

Weakness

The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Software

Name Vendor Start Version End Version
Mysql Mysql 5.1.5 5.1.5
Mysql Mysql 5.1.23 5.1.23
Mysql Mysql 5.1.32 5.1.32
Mysql Oracle 5.1 5.1
Mysql Oracle 5.1.1 5.1.1
Mysql Oracle 5.1.2 5.1.2
Mysql Oracle 5.1.3 5.1.3
Mysql Oracle 5.1.4 5.1.4
Mysql Oracle 5.1.6 5.1.6
Mysql Oracle 5.1.7 5.1.7
Mysql Oracle 5.1.8 5.1.8
Mysql Oracle 5.1.9 5.1.9
Mysql Oracle 5.1.10 5.1.10
Mysql Oracle 5.1.11 5.1.11
Mysql Oracle 5.1.12 5.1.12
Mysql Oracle 5.1.13 5.1.13
Mysql Oracle 5.1.14 5.1.14
Mysql Oracle 5.1.15 5.1.15
Mysql Oracle 5.1.16 5.1.16
Mysql Oracle 5.1.17 5.1.17
Mysql Oracle 5.1.18 5.1.18
Mysql Oracle 5.1.19 5.1.19
Mysql Oracle 5.1.20 5.1.20
Mysql Oracle 5.1.21 5.1.21
Mysql Oracle 5.1.22 5.1.22
Mysql Oracle 5.1.30 5.1.30
Red Hat Enterprise Linux 4 RedHat mysql-0:4.1.22-2.el4_8.3 *
Red Hat Enterprise Linux 5 RedHat mysql-0:5.0.77-4.el5_4.2 *
Mysql-5.1 Ubuntu devel *
Mysql-5.1 Ubuntu maverick *
Mysql-5.1 Ubuntu natty *
Mysql-dfsg Ubuntu dapper *
Mysql-dfsg-4.1 Ubuntu dapper *
Mysql-dfsg-5.0 Ubuntu dapper *
Mysql-dfsg-5.0 Ubuntu hardy *
Mysql-dfsg-5.0 Ubuntu intrepid *
Mysql-dfsg-5.0 Ubuntu jaunty *
Mysql-dfsg-5.0 Ubuntu karmic *
Mysql-dfsg-5.1 Ubuntu jaunty *
Mysql-dfsg-5.1 Ubuntu karmic *
Mysql-dfsg-5.1 Ubuntu lucid *

Potential Mitigations

  • Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References