ISS X-Force Database: mysql-changedb-privilege-escalation(34348): MySQL mysql_change

MySQL mysql_change_db privilege escalation

mysql-changedb-privilege-escalation (34348)

Medium Risk

Description:

MySQL could allow an authenticated remote attacker to gain elevated privileges on the system, caused by a vulnerability in the mysql_change_db function. An attacker could exploit this vulnerability using the SQL SECURITY INVOKER to gain elevated privileges.

Platforms Affected:

Canonical, Ubuntu 6.06 LTS
Canonical, Ubuntu 6.10
Canonical, Ubuntu 7.04
Canonical, Ubuntu 7.10
Debian, Debian Linux 3.1
Debian, Debian Linux 4.0
MandrakeSoft, Mandrake Linux 2007
MandrakeSoft, Mandrake Linux 2007 X86_64
MandrakeSoft, Mandrake Linux 2007.1 X86_64
MandrakeSoft, Mandrake Linux 2007.1
MandrakeSoft, Mandrake Linux Corporate Server 4.0
MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
MySQL, MySQL 5.0
MySQL, MySQL 5.0.0 Alpha
MySQL, MySQL 5.0.0
MySQL, MySQL 5.0.0.0
MySQL, MySQL 5.0.1
MySQL, MySQL 5.0.10
MySQL, MySQL 5.0.10a
MySQL, MySQL 5.0.11
MySQL, MySQL 5.0.12
MySQL, MySQL 5.0.13
MySQL, MySQL 5.0.14
MySQL, MySQL 5.0.15
MySQL, MySQL 5.0.15a
MySQL, MySQL 5.0.16
MySQL, MySQL 5.0.16a
MySQL, MySQL 5.0.17
MySQL, MySQL 5.0.17a
MySQL, MySQL 5.0.18
MySQL, MySQL 5.0.19
MySQL, MySQL 5.0.1a
MySQL, MySQL 5.0.2
MySQL, MySQL 5.0.20
MySQL, MySQL 5.0.20a
MySQL, MySQL 5.0.21
MySQL, MySQL 5.0.22
MySQL, MySQL 5.0.22.1.0.1
MySQL, MySQL 5.0.24
MySQL, MySQL 5.0.27
MySQL, MySQL 5.0.3 Beta
MySQL, MySQL 5.0.3
MySQL, MySQL 5.0.33
MySQL, MySQL 5.0.37
MySQL, MySQL 5.0.3a
MySQL, MySQL 5.0.4
MySQL, MySQL 5.0.4a
MySQL, MySQL 5.0.5
MySQL, MySQL 5.0.6
MySQL, MySQL 5.0.7
MySQL, MySQL 5.0.8
MySQL, MySQL 5.0.9
MySQL, MySQL 5.1.1
MySQL, MySQL 5.1.10
MySQL, MySQL 5.1.11
MySQL, MySQL 5.1.12
MySQL, MySQL 5.1.13
MySQL, MySQL 5.1.14
MySQL, MySQL 5.1.15
MySQL, MySQL 5.1.16
MySQL, MySQL 5.1.17
MySQL, MySQL 5.1.2
MySQL, MySQL 5.1.3
MySQL, MySQL 5.1.4
MySQL, MySQL 5.1.5
MySQL, MySQL 5.1.6
MySQL, MySQL 5.1.7
MySQL, MySQL 5.1.8
MySQL, MySQL 5.1.9
RedHat, Application Stack v1 for EL AS 4
RedHat, Application Stack v1 for EL ES 4
RedHat, Enterprise Linux 5 Client Workstation
RedHat, Enterprise Linux 5
RedHat, Enterprise Linux 5 Client

Remedy:

Upgrade to the latest version of MySQL (5.0.40 or 5.1.18 or later), available from the MySQL Web site. See References.

For other distributions:
Apply the appropriate update for your system. See References.

Consequences:

Gain Privileges

References:

MySQL 5.1 Reference Manual, C.1.2. Changes in release 5.1.18 (08 May 2007) at http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html.
MySQL Web site, MySQL AB :: The world's most popular open source database at http://www.mysql.com/.
ASA-2007-382: MySQL security update (RHSA-2007-0894)
BID-24011: MySQL Security Invoker Privilege Escalation Vulnerability
CVE-2007-2692: The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.
DSA-1413: mysql -- multiple vulnerabilities
FrSIRT/ADV-2007-1804: MySQL Multiple Query Handling Privilege Escalation and Security Bypass Vulnerabilities
MDVSA-2008:028: Updated MySQL packages fix multiple vulnerabilities
RHSA-2007-0894: Important: mysql security update
RHSA-2008-0364: Low: mysql security and bug fix update
SA25301: MySQL Denial of Service Vulnerability and Multiple Security Issues
SECTRACK ID: 1018070: MySQL SQL SECURITY INVOKER Routines Let Remote Authenticated Users Gain Elevated Privileges
SUSE-SR:2008:003: SUSE Security Summary Report
USN-588-1: MySQL vulnerabilities
USN-588-2: MySQL regression

Reported:

May 08, 2007

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page