The mysqlhotcopy script in mysql 4.0.20 and earlier, when using the scp method from the mysql-server package, allows local users to overwrite arbitrary files via a symlink attack on temporary files.

According to Christian Hammers :

[mysqlhotcopy created] temporary files in /tmp which had predictable filenames and such could be used for a tempfile run attack.

Jeroen van Wolffelaar is credited with discovering the issue.

A number of problems have been discovered in the MySQL database server :

Jeroen van Wolffelaar discovered an insecure temporary file vulnerability in the mysqlhotcopy script when using the scp method (CVE-2004-0457).

Oleksandr Byelkin discovered that the 'ALTER TABLE ... RENAME' would check the CREATE/INSERT rights of the old table rather than the new one (CVE-2004-0835).

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION can cause the server to crash or stall (CVE-2004-0837).

The updated MySQL packages have been patched to protect against these issues.

Updated mysql packages that fix various security issues, as well as a number of bugs, are now available for Red Hat Enterprise Linux 2.1.

MySQL is a multi-user, multi-threaded SQL database server.

A number security issues that affect the mysql server have been reported :

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0835 to this issue.

Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CVE-2004-0836).

Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CVE-2004-0837).

Sergei Golubchik discovered that if a user is granted privileges to a database with a name containing an underscore ('_'), the user also gains the ability to grant privileges to other databases with similar names (CVE-2004-0957).

Additionally, the following minor temporary file vulnerabilities were discovered :

  - Stan Bubroski and Shaun Colley found a temporary file     vulnerability in the mysqlbug script (CVE-2004-0381). -     A temporary file vulnerability was discovered in     mysqld_multi (CVE-2004-0388). - Jeroen van Wolffelaar     discovered an temporary file vulnerability in the     mysqlhotcopy script when using the scp method     (CVE-2004-0457).

All users of mysql should upgrade to these updated packages, which resolve these issues and also include fixes for a number of small bugs.

Updated mysql packages that fix various temporary file security issues, as well as a number of bugs, are now available.

MySQL is a multi-user, multi-threaded SQL database server.

This update fixes a number of small bugs, including some potential security problems associated with careless handling of temporary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0381, CVE-2004-0388, and CVE-2004-0457 to these issues.

A number of additional security issues that affect mysql have been corrected in the source package. These include CVE-2004-0835, CVE-2004-0836, CVE-2004-0837, and CVE-2004-0957. Red Hat Enterprise Linux 3 does not ship with the mysql-server package and is therefore not affected by these issues.

This update also allows 32-bit and 64-bit libraries to be installed concurrently on the same system.

All users of mysql should upgrade to these updated packages, which resolve these issues.

Jeroen van Wolffelaar discovered an insecure temporary file vulnerability in the mysqlhotcopy script when using the scp method which is part of the mysql-server package.

The remote host is affected by the vulnerability described in GLSA-200409-02 (MySQL: Insecure temporary file creation in mysqlhotcopy)

    Jeroen van Wolffelaar discovered that the MySQL database hot copy utility     (mysqlhotcopy.sh), when using the scp method, uses temporary files with     predictable names. A malicious local user with write access to the /tmp     directory could create a symbolic link pointing to a file, which may then     be overwritten. In cases where mysqlhotcopy is run as root, a malicious     user could create a symlink to a critical file such as /etc/passwd and     cause it to be overwritten.
  Impact :

    A local attacker could use this vulnerability to destroy other users' data     or corrupt and destroy system files, possibly leading to a denial of     service condition.
  Workaround :

    There is no known workaround at this time.

You are running a version of MySQL which is older than version 4.0.21.

Mysqlhotcopy is reported to contain an insecure temporary file creation vulnerability. The result of this is that temporary files created by the application may use predictable filenames. 

A local attacker could potentially exploit this vulnerability to execute symbolic link file overwrite attacks. 

*** Note : this vulnerability is local only

The remote host is running a version of MySQL that is older than version 3.23.49 or than 4.0.20.  The version of the utility Mysqlhotcopy included in these versions of MySQL is reported to be prone to a vulnerability that may permit an attacker to overwrite arbitrary files on the database server with the privilege of the targeted user. Privilege escalation may also be possible. An attacker requires local interactive access in order to exploit this vulnerability. 

ID	Name	Product	Family	Type	Severity
37724	FreeBSD : mysql -- mysqlhotcopy insecure temporary file creation (0c4d5973-f2ab-11d8-9837-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	Local	medium
15599	Mandrake Linux Security Advisory : MySQL (MDKSA-2004:119)	Nessus	Mandriva Local Security Checks	Local	critical
15536	RHEL 2.1 : mysql (RHSA-2004:597)	Nessus	Red Hat Local Security Checks	Local	critical
15534	RHEL 3 : mysql (RHSA-2004:569)	Nessus	Red Hat Local Security Checks	Local	medium
15377	Debian DSA-540-1 : mysql - insecure file creation	Nessus	Debian Local Security Checks	Local	medium
14649	GLSA-200409-02 : MySQL: Insecure temporary file creation in mysqlhotcopy	Nessus	Gentoo Local Security Checks	Local	medium
14343	MySQL < 4.0.21 mysqlhotcopy Insecure Temporary File Creation	Nessus	Databases	Remote	medium
2129	Oracle MySQL Mysqlhotcopy Script Insecure Temporary File Creation	Nessus Network Monitor	Database		high

Detections

Analytics

CVE-2004-0457

medium

Tenable Plugins

medium

critical

critical

medium

medium

medium

medium

high