MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf.

The version of MySQL installed on the remote host is older than 3.23.56.  As such, it reportedly creates world-writeable files.  By restarting the MySQL daemon under root ID, a local attacker could gain root privileges.

CAN-2003-0073: The mysql package contains a bug whereby dynamically allocated memory is freed more than once, which could be deliberately triggered by an attacker to cause a crash, resulting in a denial of service condition. In order to exploit this vulnerability, a valid username and password combination for access to the MySQL server is required.

CAN-2003-0150: The mysql package contains a bug whereby a malicious user, granted certain permissions within mysql, could create a configuration file which would cause the mysql server to run as root, or any other user, rather than the mysql user.

The remote host is running a version of MySQL which is older than version 3.23.55. If you have not patched this version, then any attacker with a valid username may crash this service remotely by exploiting a double free bug.
 Further exploitation to gain a shell on the host may also be possible. 

The remote host is running a version of MySQL which is older than version 3.23.56. A vulnerability exists that may allow the mysqld service to start with elevated privileges. An attacker can exploit this vulnerability by creating a DATADIR/my.cnf that includes the line 'user'. 

In MySQL 3.23.55 and earlier, MySQL would create world-writeable files and allow mysql users to gain root privileges by using the 'SELECT * INTO OUTFILE' operator to overwrite a configuration file, which could cause mysql to run as root upon restarting the daemon.

This has been fixed upstream in version 3.23.56, which is provided for Mandrake Linux 9.0 and Corporate Server 2.1 users. The other updated packages have been patched to correct this issue.

Updated packages are available that fix both a double-free security vulnerability and a remote root exploit security vulnerability found in the MySQL server.

[Updated 11 Aug 2003] Updated mysqlclient9 packages are now included.
These were previously missing from this erratum.

MySQL is a multi-user, multi-threaded SQL database server.

A double-free vulnerability in mysqld, for MySQL before version 3.23.55, allows attackers with MySQL access to cause a denial of service (crash) by creating a carefully crafted client application.

A remote root exploit vulnerability in mysqld, for MySQL before version 3.23.56, allows MySQL users to gain root privileges by overwriting configuration files.

Previous versions of the MySQL packages do not contain the thread safe client library (libmysqlclient_r).

All users of MySQL are advised to upgrade to these errata packages containing MySQL 3.23.56.

The remote version of MySQL is older than 3.23.56.  Such versions are affected by an issue that may allow the mysqld service to start with elevated privileges.  An attacker can exploit this vulnerability by creating a 'DATADIR/my.cnf' that includes the line 'user=root' under the '[mysqld]' option section.  When the mysqld service is executed, it will run as the root user instead of the default user.

ID	Name	Product	Family	Severity
17820	MySQL < 3.23.56 Writable Configuration Files	Nessus	Databases	high
15140	Debian DSA-303-1 : mysql - privilege escalation	Nessus	Debian Local Security Checks	high
1908	Oracle MySQL < 3.23.55 Double Free() Overflow	Nessus Network Monitor	Database	high
1900	Oracle MySQL < 3.23.56 Local Privilege Escalation	Nessus Network Monitor	Database	high
14041	Mandrake Linux Security Advisory : MySQL (MDKSA-2003:057)	Nessus	Mandriva Local Security Checks	high
12378	RHEL 2.1 : mysql (RHSA-2003:094)	Nessus	Red Hat Local Security Checks	high
11378	MySQL datadir/my.cnf Modification Privilege Escalation	Nessus	Databases	high

Detections

Analytics

CVE-2003-0150

high

Tenable Plugins

high

high

high

high

high

high

high