MySQL Case-Sensitive Database Names May Let Users Access Restricted Databases
|
|
SecurityTracker Alert ID: 1016710
|
|
SecurityTracker URL: http://securitytracker.com/id?1016710
|
|
CVE Reference: CVE-2006-4226
(Links to External Site)
|
Updated: Sep 5 2006
|
Original Entry Date: Aug 17 2006
|
Impact: Disclosure of user information, Modification of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 5.0.25
|
Description: A vulnerability was reported in MySQL. A remote authenticated user may be able to access a restricted database.
On Linux-based systems or systems with case-sensitive filesystems, an authenticated user with rights to acess a database may be able
to create or access a different database that has the same name as the original database but where one or more letters has a different
case.
Michal Prokopiuk reported this vulnerability.
|
Impact: A remote authenticated user may be able to access a restricted database in certain cases.
|
Solution: The vendor has issued a fix. The fix is planned for inclusion in upcoming version 5.0.25.
The MySQL advisory is available at:
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
|
Vendor URL: dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 17 Aug 2006 14:43:03 -0400
Subject: MySQL, Changes in release 5.0.25 (Not yet released)
|
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
#
Security fix: On Linux, and possibly other platforms using case-sensitive filesystems,
it was possible for a user granted rights on a database to create or access a database
whose name differed only from that of the first by the case of one or more letters.
(Bug#17647)
#
Security fix: A stored routine created by one user and then made accessible to a
different user using GRANT EXECUTE could be executed by that user with the privileges
of the routine's definer. (Bug#18630)
|
|
