CVE-2009-4030: Medium severity mysql vulnerability
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4030 to the following vulnerability:
MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysqlunpackedrealdatahome value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
References: ----------- http://lists.mysql.com/commits/89940 http://www.openwall.com/lists/oss-security/2009/11/19/3 http://marc.info/?l=oss-security&m=125908040022018&w=2 http://www.openwall.com/lists/oss-security/2009/11/24/6 http://marc.info/?l=oss-security&m=125908080222685&w=2 http://bugs.mysql.com/bug.php?id=32167 http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html
Upstream patch: --------------- http://lists.mysql.com/commits/52326
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-4030?
CVE-2009-4030 is classified as a security vulnerability that allows local users to bypass certain privilege checks.
How do I fix CVE-2009-4030?
To fix CVE-2009-4030, you should upgrade MySQL to version 5.1.41 or later.
Which MySQL versions are affected by CVE-2009-4030?
CVE-2009-4030 affects MySQL versions prior to 5.1.41.
Who is impacted by CVE-2009-4030?
Local users of affected MySQL installations are impacted by CVE-2009-4030.
What is the nature of the vulnerability in CVE-2009-4030?
CVE-2009-4030 allows local users to create MyISAM tables without proper privilege checks, potentially escalating their privileges.