CVE-2007-6303: Low severity MySQL mysql vulnerability

Published Dec 10, 2007

Updated

MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement.

Affected Software

29 affected components

MySQL mysql=5.0.5

MySQL mysql=5.0.10

MySQL mysql=5.0.0

MySQL mysql=5.0.15

MySQL mysql=5.0.17

MySQL mysql=5.0.5.0.21

MySQL mysql=5.0.3

MySQL mysql=5.0.24

MySQL mysql=5.0.2

MySQL mysql=5.0.22.1.0.1

MySQL mysql=5.0.20

MySQL mysql=5.0.1

MySQL mysql=5.0.4

MySQL mysql=5.0.16

Oracle MySQL=6.0.0

Oracle MySQL=6.0.1

Oracle MySQL=6.0.2

Oracle MySQL=6.0.3

Oracle MySQL=5.0.41

Oracle MySQL=5.1.1

Oracle MySQL=5.1.2

Oracle MySQL=5.1.10

Oracle MySQL=5.1.11

Oracle MySQL=5.1.12

Oracle MySQL=5.1.13

Oracle MySQL=5.1.14

Oracle MySQL=5.1.15

Oracle MySQL=5.1.16

Oracle MySQL=5.1.17

Event History

Dec 10, 2007

CVE Published

09:46 PM

Dec 11, 2007

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-6303?

CVE-2007-6303 is considered a medium severity vulnerability as it allows authenticated remote users to escalate their privileges in MySQL configurations.

How do I fix CVE-2007-6303?

To fix CVE-2007-6303, upgrade your MySQL installation to version 5.0.51a, 5.1.23, or a later version.

What versions of MySQL are affected by CVE-2007-6303?

CVE-2007-6303 affects MySQL versions 5.0.0 to 5.0.51, 5.1.0 to 5.1.22, and all pre-6.0.4 versions.

Can CVE-2007-6303 be exploited remotely?

Yes, CVE-2007-6303 can be exploited remotely by authenticated users to gain elevated privileges.

What is the main issue caused by CVE-2007-6303?

The main issue caused by CVE-2007-6303 is that the DEFINER value of views in MySQL is not updated when the view is altered, allowing privilege escalation.