MySQL before 5.1.46 allows local users to delete the data and index files of another users MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.
Weakness
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mysql | Mysql | * | 5.1.45 (including) |
| Mysql | Mysql | 5.0.5.0.21 (including) | 5.0.5.0.21 (including) |
| Mysql | Mysql | 5.0.15 (including) | 5.0.15 (including) |
| Mysql | Mysql | 5.0.16 (including) | 5.0.16 (including) |
| Mysql | Mysql | 5.0.17 (including) | 5.0.17 (including) |
| Mysql | Mysql | 5.0.20 (including) | 5.0.20 (including) |
| Mysql | Mysql | 5.0.24 (including) | 5.0.24 (including) |
| Mysql | Mysql | 5.0.45b (including) | 5.0.45b (including) |
| Mysql | Mysql | 5.0.82 (including) | 5.0.82 (including) |
| Mysql | Mysql | 5.0.84 (including) | 5.0.84 (including) |
| Mysql | Mysql | 5.0.87 (including) | 5.0.87 (including) |
| Mysql | Mysql | 5.1.5 (including) | 5.1.5 (including) |
| Mysql | Mysql | 5.1.23 (including) | 5.1.23 (including) |
| Mysql | Mysql | 5.1.31 (including) | 5.1.31 (including) |
| Mysql | Mysql | 5.1.32 (including) | 5.1.32 (including) |
| Mysql | Mysql | 5.1.34 (including) | 5.1.34 (including) |
| Mysql | Mysql | 5.1.37 (including) | 5.1.37 (including) |
| Mysql | Oracle | 5.0.18 (including) | 5.0.18 (including) |
| Mysql | Oracle | 5.0.19 (including) | 5.0.19 (including) |
| Mysql | Oracle | 5.0.21 (including) | 5.0.21 (including) |
| Mysql | Oracle | 5.0.22 (including) | 5.0.22 (including) |
| Mysql | Oracle | 5.0.23 (including) | 5.0.23 (including) |
| Mysql | Oracle | 5.0.27 (including) | 5.0.27 (including) |
| Mysql | Oracle | 5.0.33 (including) | 5.0.33 (including) |
| Mysql | Oracle | 5.0.37 (including) | 5.0.37 (including) |
| Mysql | Oracle | 5.0.41 (including) | 5.0.41 (including) |
| Mysql | Oracle | 5.0.45 (including) | 5.0.45 (including) |
| Mysql | Oracle | 5.0.51 (including) | 5.0.51 (including) |
| Mysql | Oracle | 5.0.67 (including) | 5.0.67 (including) |
| Mysql | Oracle | 5.0.75 (including) | 5.0.75 (including) |
| Mysql | Oracle | 5.0.77 (including) | 5.0.77 (including) |
| Mysql | Oracle | 5.0.81 (including) | 5.0.81 (including) |
| Mysql | Oracle | 5.0.83 (including) | 5.0.83 (including) |
| Mysql | Oracle | 5.0.85 (including) | 5.0.85 (including) |
| Mysql | Oracle | 5.0.86 (including) | 5.0.86 (including) |
| Mysql | Oracle | 5.0.88 (including) | 5.0.88 (including) |
| Mysql | Oracle | 5.0.89 (including) | 5.0.89 (including) |
| Mysql | Oracle | 5.0.90 (including) | 5.0.90 (including) |
| Mysql | Oracle | 5.0.91 (including) | 5.0.91 (including) |
| Mysql | Oracle | 5.1.30 (including) | 5.1.30 (including) |
| Mysql | Oracle | 5.1.33 (including) | 5.1.33 (including) |
| Mysql | Oracle | 5.1.35 (including) | 5.1.35 (including) |
| Mysql | Oracle | 5.1.36 (including) | 5.1.36 (including) |
| Mysql | Oracle | 5.1.38 (including) | 5.1.38 (including) |
| Mysql | Oracle | 5.1.39 (including) | 5.1.39 (including) |
| Mysql | Oracle | 5.1.40 (including) | 5.1.40 (including) |
| Mysql | Oracle | 5.1.41 (including) | 5.1.41 (including) |
| Mysql | Oracle | 5.1.42 (including) | 5.1.42 (including) |
| Mysql | Oracle | 5.1.43 (including) | 5.1.43 (including) |
| Mysql | Oracle | 5.1.44 (including) | 5.1.44 (including) |
| Red Hat Enterprise Linux 5 | RedHat | mysql-0:5.0.77-4.el5_5.3 | * |
| Mysql-dfsg-5.0 | Ubuntu | dapper | * |
| Mysql-dfsg-5.0 | Ubuntu | hardy | * |
| Mysql-dfsg-5.0 | Ubuntu | jaunty | * |
| Mysql-dfsg-5.0 | Ubuntu | karmic | * |
| Mysql-dfsg-5.0 | Ubuntu | upstream | * |
| Mysql-dfsg-5.1 | Ubuntu | jaunty | * |
| Mysql-dfsg-5.1 | Ubuntu | karmic | * |
| Mysql-dfsg-5.1 | Ubuntu | lucid | * |
| Mysql-dfsg-5.1 | Ubuntu | upstream | * |
Potential Mitigations
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/132.html
- https://cwe.mitre.org/data/definitions/17.html
- https://cwe.mitre.org/data/definitions/35.html
- https://cwe.mitre.org/data/definitions/76.html
References
- http://bugs.mysql.com/bug.php?id=40980
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html
- http://securitytracker.com/id?1024004
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:101
- http://www.openwall.com/lists/oss-security/2010/05/10/2
- http://www.openwall.com/lists/oss-security/2010/05/18/4
- http://www.redhat.com/support/errata/RHSA-2010-0442.html
- http://www.securityfocus.com/bid/40257
- http://www.ubuntu.com/usn/USN-1397-1
- http://www.vupen.com/english/advisories/2010/1194
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9490
- http://bugs.mysql.com/bug.php?id=40980
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html
- http://securitytracker.com/id?1024004
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:101
- http://www.openwall.com/lists/oss-security/2010/05/10/2
- http://www.openwall.com/lists/oss-security/2010/05/18/4
- http://www.redhat.com/support/errata/RHSA-2010-0442.html
- http://www.securityfocus.com/bid/40257
- http://www.ubuntu.com/usn/USN-1397-1
- http://www.vupen.com/english/advisories/2010/1194
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9490