CVE-2007-2691: Medium severity MySQL mysql vulnerability
Published May 16, 2007
·Updated
MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.
Affected Software
8 affected components
MySQL mysql<=4.1.22
MySQL mysql>=5.0<5.0.42
MySQL mysql>=5.1<5.1.18
Debian Debian Linux=3.1
Debian Debian Linux=4.0
Canonical Ubuntu Linux=6.06
Canonical Ubuntu Linux=7.04
Canonical Ubuntu Linux=6.10
Remediation
Patch Available
Event History
May 16, 2007
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-2691?
CVE-2007-2691 has a medium severity rating as it allows remote authenticated users to rename arbitrary tables.
2
How do I fix CVE-2007-2691?
To fix CVE-2007-2691, upgrade MySQL to version 4.1.23, 5.0.42, or 5.1.18 or later.
3
Which MySQL versions are affected by CVE-2007-2691?
CVE-2007-2691 affects MySQL versions before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18.
4
What type of access does CVE-2007-2691 exploit?
CVE-2007-2691 exploits the lack of required DROP privilege for RENAME TABLE statements allowing unauthorized table renames.
5
Can CVE-2007-2691 be exploited remotely?
Yes, CVE-2007-2691 can be exploited by remote authenticated users.