CVE-2007-2692: Medium severity MySQL mysql vulnerability

Published May 16, 2007

Updated

The mysqlchangedb function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::dbaccess privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.

Affected Software

48 affected components

MySQL mysql=5.0.0

MySQL mysql=5.0.1

MySQL mysql=5.0.2

MySQL mysql=5.0.3

MySQL mysql=5.0.4

MySQL mysql=5.0.5

MySQL mysql=5.0.5.0.21

MySQL mysql=5.0.10

MySQL mysql=5.0.15

MySQL mysql=5.0.16

MySQL mysql=5.0.17

MySQL mysql=5.0.20

MySQL mysql=5.0.22.1.0.1

MySQL mysql=5.0.24

MySQL mysql=5.1.5

Oracle MySQL=5.0.0-alpha

Oracle MySQL=5.0.3-beta

Oracle MySQL=5.0.6

Oracle MySQL=5.0.7

Oracle MySQL=5.0.8

Oracle MySQL=5.0.9

Oracle MySQL=5.0.11

Oracle MySQL=5.0.12

Oracle MySQL=5.0.13

Oracle MySQL=5.0.14

Oracle MySQL=5.0.18

Oracle MySQL=5.0.19

Oracle MySQL=5.0.21

Oracle MySQL=5.0.22

Oracle MySQL=5.0.27

Oracle MySQL=5.0.33

Oracle MySQL=5.0.37

Oracle MySQL=5.1.1

Oracle MySQL=5.1.2

Oracle MySQL=5.1.3

Oracle MySQL=5.1.4

Oracle MySQL=5.1.6

Oracle MySQL=5.1.7

Oracle MySQL=5.1.8

Oracle MySQL=5.1.9

Oracle MySQL=5.1.10

Oracle MySQL=5.1.11

Oracle MySQL=5.1.12

Oracle MySQL=5.1.13

Oracle MySQL=5.1.14

Oracle MySQL=5.1.15

Oracle MySQL=5.1.16

Oracle MySQL=5.1.17

Event History

May 16, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2692?

CVE-2007-2692 is classified as a moderate severity vulnerability due to its potential for privilege escalation.

How do I fix CVE-2007-2692?

To fix CVE-2007-2692, upgrade MySQL to version 5.0.40 or later for 5.0.x, and to version 5.1.18 or later for 5.1.x.

What types of software are affected by CVE-2007-2692?

CVE-2007-2692 affects MySQL versions 5.0.0 through 5.0.39 and certain 5.1.x versions prior to 5.1.18.

Who can exploit CVE-2007-2692?

Remote authenticated users can exploit CVE-2007-2692 to gain elevated privileges unexpectedly.

What vulnerabilities does CVE-2007-2692 address?

CVE-2007-2692 addresses a flaw in restoring database access privileges after executing SQL SECURITY INVOKER stored routines.