CVE-2009-4030: Medium severity MySQL mysql vulnerability

Q: What is the severity of CVE-2009-4030?

CVE-2009-4030 is classified as a security vulnerability that allows local users to bypass certain privilege checks.

Q: How do I fix CVE-2009-4030?

To fix CVE-2009-4030, you should upgrade MySQL to version 5.1.41 or later.

Q: Which MySQL versions are affected by CVE-2009-4030?

CVE-2009-4030 affects MySQL versions prior to 5.1.41.

Q: Who is impacted by CVE-2009-4030?

Local users of affected MySQL installations are impacted by CVE-2009-4030.

Q: What is the nature of the vulnerability in CVE-2009-4030?

CVE-2009-4030 allows local users to create MyISAM tables without proper privilege checks, potentially escalating their privileges.

Published Nov 4, 2009

Updated

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4030 to the following vulnerability:

MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysqlunpackedrealdatahome value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.

References: ----------- http://lists.mysql.com/commits/89940 http://www.openwall.com/lists/oss-security/2009/11/19/3 http://marc.info/?l=oss-security&m=125908040022018&w=2 http://www.openwall.com/lists/oss-security/2009/11/24/6 http://marc.info/?l=oss-security&m=125908080222685&w=2 http://bugs.mysql.com/bug.php?id=32167 http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html

Upstream patch: --------------- http://lists.mysql.com/commits/52326

Affected Software

28 affected componentsFixes available

redhat/mysql<0:4.1.22-2.el4_8.3

0:4.1.22-2.el4_8.3

redhat/mysql<0:5.0.77-4.el5_4.2

0:5.0.77-4.el5_4.2

MySQL mysql=5.1.5

MySQL mysql=5.1.23

MySQL mysql=5.1.32

Oracle MySQL=5.1

Oracle MySQL=5.1.1

Oracle MySQL=5.1.2

Oracle MySQL=5.1.3

Oracle MySQL=5.1.4

Oracle MySQL=5.1.6

Oracle MySQL=5.1.7

Oracle MySQL=5.1.8

Oracle MySQL=5.1.9

Oracle MySQL=5.1.10

Oracle MySQL=5.1.11

Oracle MySQL=5.1.12

Oracle MySQL=5.1.13

Oracle MySQL=5.1.14

Oracle MySQL=5.1.15

Oracle MySQL=5.1.16

Oracle MySQL=5.1.17

Oracle MySQL=5.1.18

Oracle MySQL=5.1.19

Oracle MySQL=5.1.20

Oracle MySQL=5.1.21

Oracle MySQL=5.1.22

Oracle MySQL=5.1.30

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 0:4.1.22-2.el4_8.3
Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 0:5.0.77-4.el5_4.2
Upgrade
Upgrade MySQL to a version that resolves this vulnerability.
Fixed in 5.1.41

Event History

Nov 4, 2009

CVE Published

via Red Hat·12:00 AM

Nov 30, 2009

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Dec 2, 2009

Data Sourced

via Red Hat·07:21 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2009-4030?

CVE-2009-4030 is classified as a security vulnerability that allows local users to bypass certain privilege checks.

How do I fix CVE-2009-4030?