| MySQL Remote/Local Exploit |
|
|
|
MySQL 4.1.x and prior Remote/Local Exploit Vulnerabilities has been found on March 11, 2005. The 3 vulnerabilities: 1) Predictable Temporary File Name 2) Arbitrary Library Injection 3) Special Crafted Commands Exploit Download Patch from MySQL : http://dev.mysql.com/downloads/ Several vulnerabilities were identified in MySQL, which may be exploited by local attackers to execute arbitrary commands or obtain elevated privileges. - The first flaw is due to an insecure (predictable name) temporary file creation with "CREATE TEMPORARY TABLE", which may be exploited by an attacker that has "CREATE TEMPORARY TABLE" privileges to conduct symlink attacks. - The second vulnerability is due to an arbitrary library injection error and resides in the "udf_init()" function (sql_udf.cc), which may be exploited by an attacker (with INSERT and DELETE privileges) to load/execute a malicious library with MySQL privileges. - The third flaw occurs when handling specially crafted "CREATE FUNCTION" commands, which may be exploited by a malicious user (with INSERT and DELETE privileges) to execute arbitrary code with MySQL privileges. * Affected Products * Mysql version 4.0.23 and prior Mysql version 4.1.10 and prior |