CVE-2006-4227: Input Validation

Published Aug 18, 2006

Updated

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

Affected Software

12 affected components

MySQL mysql=5.0.1

MySQL mysql=5.0.2

MySQL mysql=5.0.3

MySQL mysql=5.0.4

MySQL mysql=5.0.20

MySQL mysql=5.0.22.1.0.1

MySQL mysql=5.0.24

MySQL mysql=5.1.5

Oracle MySQL=5.0.0-alpha

Oracle MySQL=5.1.6

Oracle MySQL=5.1.9

Oracle MySQL=5.1.10

Event History

Aug 18, 2006

CVE Published

08:04 PM

CVE Published

via MITRE·11:55 PM

Data Sourced

via MITRE·11:55 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-4227?

CVE-2006-4227 has a moderate severity rating since it allows authenticated users to gain elevated privileges.

How do I fix CVE-2006-4227?

To fix CVE-2006-4227, upgrade MySQL to version 5.0.25 or later, or 5.1.12 or later.

What versions of MySQL are affected by CVE-2006-4227?

CVE-2006-4227 affects MySQL versions prior to 5.0.25 and 5.1 prior to 5.1.12.

What type of vulnerability is CVE-2006-4227?

CVE-2006-4227 is a privilege escalation vulnerability due to inappropriate evaluation of routine arguments.

Can remote users exploit CVE-2006-4227?

Yes, remote authenticated users can exploit CVE-2006-4227 by leveraging vulnerable routines to gain unauthorized privileges.