MySQL underscore allows elevated privileges
| mysql-underscore-gain-priv (17783) |  High Risk |
Description:
MySQL could allow an attacker to gain elevated privileges. An authenticated attacker, with privileges to a database that has an underscore in the name, could grant privileges to other databases that have a similar name, that the attacker does not have privileges to. An attacker could use this vulnerability to gain elevated privileges and read or modify sensitive information in the database.
Platforms Affected:
- Canonical, Ubuntu 4.10
- Debian, Debian Linux 3.0
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 10.1 X86_64
- MandrakeSoft, Mandrake Linux 10.1
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MySQL, MySQL 3.20
- MySQL, MySQL 3.20.32a
- MySQL, MySQL 3.21
- MySQL, MySQL 3.22
- MySQL, MySQL 3.22.26
- MySQL, MySQL 3.22.27
- MySQL, MySQL 3.22.28
- MySQL, MySQL 3.22.29
- MySQL, MySQL 3.22.30
- MySQL, MySQL 3.22.32
- MySQL, MySQL 3.23
- MySQL, MySQL 3.23.10
- MySQL, MySQL 3.23.2
- MySQL, MySQL 3.23.22
- MySQL, MySQL 3.23.23
- MySQL, MySQL 3.23.24
- MySQL, MySQL 3.23.25
- MySQL, MySQL 3.23.26
- MySQL, MySQL 3.23.27
- MySQL, MySQL 3.23.28
- MySQL, MySQL 3.23.28 Gamma
- MySQL, MySQL 3.23.29
- MySQL, MySQL 3.23.3
- MySQL, MySQL 3.23.30
- MySQL, MySQL 3.23.31
- MySQL, MySQL 3.23.32
- MySQL, MySQL 3.23.33
- MySQL, MySQL 3.23.34
- MySQL, MySQL 3.23.36
- MySQL, MySQL 3.23.37
- MySQL, MySQL 3.23.38
- MySQL, MySQL 3.23.39
- MySQL, MySQL 3.23.4
- MySQL, MySQL 3.23.40
- MySQL, MySQL 3.23.41
- MySQL, MySQL 3.23.42
- MySQL, MySQL 3.23.43
- MySQL, MySQL 3.23.44
- MySQL, MySQL 3.23.45
- MySQL, MySQL 3.23.46
- MySQL, MySQL 3.23.47
- MySQL, MySQL 3.23.48
- MySQL, MySQL 3.23.49
- MySQL, MySQL 3.23.5
- MySQL, MySQL 3.23.50
- MySQL, MySQL 3.23.51
- MySQL, MySQL 3.23.52
- MySQL, MySQL 3.23.53
- MySQL, MySQL 3.23.53a
- MySQL, MySQL 3.23.54
- MySQL, MySQL 3.23.54a
- MySQL, MySQL 3.23.55
- MySQL, MySQL 3.23.56
- MySQL, MySQL 3.23.58
- MySQL, MySQL 3.23.59
- MySQL, MySQL 3.23.8
- MySQL, MySQL 3.23.9
- MySQL, MySQL 4.0.0
- MySQL, MySQL 4.0.1
- MySQL, MySQL 4.0.10
- MySQL, MySQL 4.0.11
- MySQL, MySQL 4.0.11 Gamma
- MySQL, MySQL 4.0.12
- MySQL, MySQL 4.0.13
- MySQL, MySQL 4.0.14
- MySQL, MySQL 4.0.15
- MySQL, MySQL 4.0.18
- MySQL, MySQL 4.0.2
- MySQL, MySQL 4.0.20
- MySQL, MySQL 4.0.3
- MySQL, MySQL 4.0.4
- MySQL, MySQL 4.0.5
- MySQL, MySQL 4.0.5A
- MySQL, MySQL 4.0.6
- MySQL, MySQL 4.0.7 Gamma
- MySQL, MySQL 4.0.7
- MySQL, MySQL 4.0.8
- MySQL, MySQL 4.0.8 Gamma
- MySQL, MySQL 4.0.9
- MySQL, MySQL 4.0.9 Gamma
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Linux Advanced Workstation 2.1 Itanium
- RedHat, RHEL Extras 3
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux 8 Workstation
- Turbolinux, Turbolinux Home
- Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
- Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
Remedy:
Upgrade to the latest version of MySQL (4.0.21 or later), available from the MySQL Web site. See References.
For Red Hat Linux:
Upgrade to the latest mysql-server package, as listed below. Refer to RHSA-2004:611-04 for more information. See References.
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), WS (v. 3), Desktop: 3.23.58-2.3.x86_64 or later.
For Ubuntu Linux:
Upgrade to the latest mysql-server package (4.0.20-2ubuntu1.1 or later), as listed in USN-32-1 November 25, 2004. See References.
For Debian GNU/Linux:
Refer to DSA-707-1 for patch, upgrade, or suggested workaround information. See References.
For Ubuntu Linux:
Refer to USN-32-1 and USN-109-1 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Privileges
References:
- C.3.2 Changes in release 4.0.21 (06 Sep 2004), MySQL Manual | C.3.2 Changes in release 4.0.21 (06 Sep 2004) at http://dev.mysql.com/doc/mysql/en/News-4.0.21.html.
- CIAC Information Bulletin P-018, Red Hat Update MySQL Packages Fix Security Issues and Bugs at http://www.ciac.org/ciac/bulletins/p-018.shtml.
- MySQL Bug #3933 29 May 10:25am, MySQL Bug #3933: one can grant privileges on the db he has no privileges on at http://bugs.mysql.com/bug.php?id=3933.
- MySQL Web site, MySQL:The World's Most Popular Open Source Database at http://www.mysql.com/.
- Trustix Secure Linux Security Advisory #2004-0054, Multiple security vulnerabilities at http://www.trustix.net/errata/2004/0054/.
- BID-11435: MySQL Database Unauthorized GRANT Privilege Vulnerability
- CVE-2004-0957: Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user has privileges for a database whose name includes a _ (underscore), grants privileges to other databases that have similar names, which can allow the user to conduct unauthorized activities.
- DSA-707: mysql -- several vulnerabilities
- MDKSA-2005:070: Updated MySQL packages fix vulnerability
- RHSA-2004-597: mysql security update
- RHSA-2004-611: mysql-server security update
- SUSE-SR:2004:001: SUSE Security Summary Report
Reported:
Sep 06, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net