CVE-2008-7247: Medium severity mysql vulnerability
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7247 to the following vulnerability:
sql/sqltable.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink.
References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7247 http://lists.mysql.com/commits/59711 http://marc.info/?l=oss-security&m=125908040022018&w=2 http://bugs.mysql.com/bug.php?id=39277
Upstream patch: --------------- http://lists.mysql.com/commits/59711
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-7247?
CVE-2008-7247 has a high severity as it allows authenticated users to bypass access restrictions, potentially leading to unauthorized data access.
How do I fix CVE-2008-7247?
To fix CVE-2008-7247, update MySQL to a version newer than 5.0.88 or 5.1.41, or apply any provided patches that address this vulnerability.
Which versions of MySQL are affected by CVE-2008-7247?
CVE-2008-7247 affects MySQL versions 5.0.5 through 5.0.88 and 5.1.5 through 5.1.41, as well as 6.0 before 6.0.9-alpha.
What causes the vulnerability in CVE-2008-7247?
CVE-2008-7247 is caused by MySQL allowing remote authenticated users to use CREATE TABLE with a DATA DIRECTORY option that points to a symlink, bypassing intended access controls.
Who can be impacted by CVE-2008-7247?
Any environment running the affected versions of MySQL with remote authenticated users may be impacted by CVE-2008-7247, risking unauthorized data access.