MySQL May Let Remote Authenticated Users Access Restricted Tables or Crash the System
|
|
SecurityTracker Alert ID: 1011606 |
|
SecurityTracker URL: http://securitytracker.com/id/1011606
|
|
CVE Reference:
CVE-2004-0835, CVE-2004-0837
(Links to External Site)
|
Updated: May 5 2009
|
Original Entry Date: Oct 11 2004
|
Impact:
Denial of service via network, User access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 3.23
|
Description:
Two vulnerabilities were reported in MySQL. A remote authenticated user may be able to gain elevated privileges. A remote authenticated user may be able to cause denial of service conditions.
In March 2004, Oleksandr Byelkin reported that an 'alter table [...] rename [...]' command will check the create/insert rights of the old table instead of the new table [CVE: CVE-2004-0835]. As a result, a user may be able to gain access to tables that the user is not authorized to access.
In January 2004, Dean Ellis reported that if multiple threads issue 'alter' commands against 'merge' tables to modify the 'union', the target server may crash [CVE: CVE-2004-0837].
The original bug reports are available at:
http://bugs.mysql.com/bug.php?id=3270
http://bugs.mysql.com/bug.php?id=2408
|
Impact:
A remote authenticated user may be able to gain elevated privileges.
A remote authenticated user may be able to cause denial of service conditions.
|
Solution:
The vendor has issued a fix, available via the source tree. Information about accessing the source trees is available at:
http://www.mysql.com/doc/en/Installing_source_tree.html
|
Vendor URL: www.mysql.com/ (Links to External Site)
|
Cause:
Access control error, Exception handling error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
