Vulnerability Note VU#203897

MySQL allows default user to be changed to root via custom "my.cnf" file

Overview

MySQL reads configuration options from world-writeable files. This can lead to a remote user gaining elevated privileges.

I. Description

A message posted to the bugtraq mailing list details a vulnerability affecting versions of MySQL prior to 3.23.56. MySQL would permit users with 'FILE' permissions to create and edit world-writeable configuration files. Upon rebooting the server, MySQL would read these files and be configured to give a remote user elevated privileges.

II. Impact

Exploitation of this vulnerability can lead to a remote user gaining elevated privileges and subsequently gaining control of the MySQL database.

III. Solution

Version 3.23.56 of MySQL resolves this issue. Likewise, you may apply the patch or upgrade supplied by your vendor for this issue.

Systems Affected

Vendor	Status	Date Notified
MySQL	Vulnerable	18-Mar-2003
OpenPKG	Vulnerable	18-Mar-2003
Trustix	Vulnerable	18-Mar-2003

References

http://lists.mysql.com/cgi-ez/ezmlm-cgi?2:mss:159:200303:anlmcilggaommdkbcboe

Credit

Thanks to Gufino for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

Date Public:	2003-03-08
Date First Published:	2003-03-18
Date Last Updated:	2003-03-20
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	9.43
Document Revision:	6

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader