CVE-2007-5970: Medium severity ORACLE MySQL vulnerability

Published Dec 10, 2007

Updated

MySQL 5.1.x before 5.1.23 and 6.0.x before 6.0.4 allows remote authenticated users to gain privileges on arbitrary tables via unspecified vectors involving use of table-level DATA DIRECTORY and INDEX DIRECTORY options when creating a partitioned table with the same name as a table on which the user lacks privileges.

Affected Software

15 affected components

ORACLE MySQL=6.0.0

ORACLE MySQL=6.0.1

ORACLE MySQL=6.0.2

ORACLE MySQL=6.0.3

ORACLE MySQL=6.0.4

ORACLE MySQL=5.1.1

ORACLE MySQL=5.1.2

ORACLE MySQL=5.1.10

ORACLE MySQL=5.1.11

ORACLE MySQL=5.1.12

ORACLE MySQL=5.1.13

ORACLE MySQL=5.1.14

ORACLE MySQL=5.1.15

ORACLE MySQL=5.1.16

ORACLE MySQL=5.1.17

Event History

Dec 10, 2007

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5970?

CVE-2007-5970 has a high severity rating due to its potential to allow privilege escalation for authenticated users.

How do I fix CVE-2007-5970?

To fix CVE-2007-5970, upgrade MySQL to version 5.1.23 or later, or 6.0.4 or later to mitigate the vulnerability.

Who is affected by CVE-2007-5970?

CVE-2007-5970 affects MySQL versions 5.1.1 through 5.1.22 and 6.0.0 through 6.0.3.

What types of user interactions lead to CVE-2007-5970 being exploited?

CVE-2007-5970 can be exploited by remote authenticated users who create partitioned tables with specific naming conflicts.

Are there any known exploits for CVE-2007-5970?

While there are no publicly known exploits for CVE-2007-5970, the vulnerability's nature suggests potential for exploitation in specific scenarios.