Privilege escalation

2008-09-1815:04:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

Low

4.6 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:S/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

8.3%

JSON

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.

CPENameOperatorVersion
ubuntu_linuxeq6.06
ubuntu_linuxeq9.04
ubuntu_linuxeq7.10
ubuntu_linuxeq8.04
ubuntu_linuxeq8.10
ubuntu_linuxeq9.10
debian_linuxeq5.0
mysqleq5.0.5
mysqleq5.0.10
mysqleq5.0.54

Name	Operator	Version
ubuntu_linux	eq	6.06
ubuntu_linux	eq	9.04
ubuntu_linux	eq	7.10
ubuntu_linux	eq	8.04
ubuntu_linux	eq	8.10
ubuntu_linux	eq	9.10
debian_linux	eq	5.0
mysql	eq	5.0.5
mysql	eq	5.0.10
mysql	eq	5.0.54