The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.

SunOS 5.10_x86 : mysql patch.
Date this patch was last updated by Sun : Jun/27/08

SunOS 5.10 : mysql patch.
Date this patch was last updated by Sun : Jun/27/08

The version of MySQL installed on the remote host is older than 3.23.50, 4.0.24, 4.1.6 or 5.0.3.  As such, the mysqlaccess script included with it reportedly could be used to read or overwrite arbitrary files via a symlink attack.

Javier Fernandez-Sanguino Pena noticed that the 'mysqlaccess' program created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Debian Security Team reports :

Javier Fernandez-Sanguino Pena from the Debian Security Audit Project discovered a temporary file vulnerability in the mysqlaccess script of MySQL that could allow an unprivileged user to let root overwrite arbitrary files via a symlink attack and could also could unveil the contents of a temporary file which might contain sensitive information.

The remote host is affected by the vulnerability described in GLSA-200501-33 (MySQL: Insecure temporary file creation)

    Javier Fernandez-Sanguino Pena from the Debian Security Audit     Project discovered that the 'mysqlaccess' script creates temporary     files in world-writeable directories with predictable names.
  Impact :

    A local attacker could create symbolic links in the temporary     files directory, pointing to a valid file somewhere on the filesystem.
    When the mysqlaccess script is executed, this would result in the file     being overwritten with the rights of the user running the software,     which could be the root user.
  Workaround :

    There is no known workaround at this time.

A temporary file vulnerability in the mysqlaccess script in MySQL was discovered by Javier Fernandez-Sanguino Pena. This flaw could allow an unprivileged user to let root overwrite arbitrary files via a symlink attack. It could also be used to view the contents of a temporary file which could contain sensitive information.

The updated packages have been patched to prevent these problems.

Javier Fernandez-Sanguino Pena from the Debian Security Audit Project discovered a temporary file vulnerability in the mysqlaccess script of MySQL that could allow an unprivileged user to let root overwrite arbitrary files via a symlink attack and could also could unveil the contents of a temporary file which might contain sensitive information.

ID	Name	Product	Family	Severity
107863	Solaris 10 (x86) : 120293-02	Nessus	Solaris Local Security Checks	high
107361	Solaris 10 (sparc) : 120292-02	Nessus	Solaris Local Security Checks	high
17838	MySQL < 3.23.50 / 4.0.24 / 4.1.6 / 5.0.3 Insecure Temporary File Creation	Nessus	Databases	medium
20682	Ubuntu 4.10 : mysql-dfsg vulnerability (USN-63-1)	Nessus	Ubuntu Local Security Checks	medium
19128	FreeBSD : mysql-scripts -- mysqlaccess insecure temporary file creation (ce109fd4-67f3-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
16424	GLSA-200501-33 : MySQL: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	medium
16379	Mandrake Linux Security Advisory : MySQL (MDKSA-2005:036)	Nessus	Mandriva Local Security Checks	medium
16214	Debian DSA-647-1 : mysql - insecure temporary files	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2005-0004

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium