CVE-2010-2008: Command Injection
MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2008?
CVE-2010-2008 has a severity rating that indicates it allows denial of service attacks, resulting in server crashes and potential database loss.
How do I fix CVE-2010-2008?
To fix CVE-2010-2008, upgrade to MySQL version 5.1.48 or later.
Who is affected by CVE-2010-2008?
CVE-2010-2008 affects MySQL versions prior to 5.1.48 and various versions of Ubuntu and Fedora that include vulnerable MySQL installations.
What type of attack does CVE-2010-2008 facilitate?
CVE-2010-2008 facilitates denial of service attacks through specially crafted ALTER DATABASE commands.
Is there a workaround for CVE-2010-2008?
There are no specific workarounds for CVE-2010-2008; upgrading to a fixed version is recommended.