MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.

From Red Hat Security Advisory 2007:0152 :

Updated mysql packages that fix a security flaw are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries.

A flaw was found in the way MySQL handled case sensitive database names. A user with the ability to create databases could gain unauthorized access to other databases hosted by the MySQL server.
(CVE-2006-4226)

This flaw does not affect the version of MySQL distributed with Red Hat Enterprise Linux 2.1, 3, or 5.

All users of the MySQL server are advised to upgrade to these updated packages, which contain a backported patch which fixes this issue.

The version of MySQL installed on the remote host is earlier than 4.1.21 / 5.0.25 / 5.1.12 and thus reportedly allows a remote user who has access rights on one database to access another database if the names differ only in case.

This update of mysql fixes several security vulnerabilities.
(CVE-2006-4031 / CVE-2006-4226 / CVE-2006-4227)

This update of mysql fixes several security vulnerabilities.
(CVE-2006-4031,CVE-2006-4226,CVE-2006-4227)

Updated mysql packages that fix a security flaw are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries.

A flaw was found in the way MySQL handled case sensitive database names. A user with the ability to create databases could gain unauthorized access to other databases hosted by the MySQL server.
(CVE-2006-4226)

This flaw does not affect the version of MySQL distributed with Red Hat Enterprise Linux 2.1, 3, or 5.

All users of the MySQL server are advised to upgrade to these updated packages, which contain a backported patch which fixes this issue.

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.9 or a version of Mac OS X 10.3 that does not have Security Update 2007-003 applied. This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

The remote host is running a version of Mac OS X 10.4 which is older than version 10.4.9 or a version of Mac OS X 10.3 which does not have Security Update 2007-003 applied.

This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously created MERGE table, even after the user's privileges are revoked for the original table, which might violate intended security policy (CVE-2006-4031).

The update allows the local admin to override MERGE using the '--skip-merge' option when running mysqld. This can be defined under MYSQLD_OPTIONS in /etc/sysconfig/mysqld. If '--skip-merge' is not used, the old behaviour of MERGE tables is still used.

MySQL 4.1 before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions (CVE-2006-4226).

Packages have been patched to correct these issues.

Michal Prokopiuk reports a privilege escalation in MySQL. The vulnerability causes MySQL, when run on case-sensitive filesystems, to allow remote and local authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.

Several local vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-4226     Michal Prokopiuk discovered that remote authenticated     users are permitted to create and access a database if     the lowercase spelling is the same as one they have been     granted access to.

  - CVE-2006-4380     Beat Vontobel discovered that certain queries replicated     to a slave could crash the client and thus terminate the     replication.

ID	Name	Product	Family	Severity
67470	Oracle Linux 4 : mysql (ELSA-2007-0152)	Nessus	Oracle Linux Local Security Checks	low
17807	MySQL < 4.1.21 / 5.0.25 / 5.1.12 Access Control	Nessus	Databases	low
29524	SuSE 10 Security Update : mysql (ZYPP Patch Number 2073)	Nessus	SuSE Local Security Checks	medium
27358	openSUSE 10 Security Update : mysql (mysql-2075)	Nessus	SuSE Local Security Checks	medium
25007	CentOS 4 : mysql (CESA-2007:0152)	Nessus	CentOS Local Security Checks	low
24951	RHEL 4 : mysql (RHSA-2007:0152)	Nessus	Red Hat Local Security Checks	low
3947	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus Network Monitor	Web Clients	high
24811	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus	MacOS X Local Security Checks	critical
23896	Mandrake Linux Security Advisory : MySQL (MDKSA-2006:149)	Nessus	Mandriva Local Security Checks	low
22923	FreeBSD : mysql -- database 'case-sensitive' privilege escalation (a0e92718-6603-11db-ab90-000e35fd8194)	Nessus	FreeBSD Local Security Checks	low
22711	Debian DSA-1169-1 : mysql-dfsg-4.1 - several vulnerabilities	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2006-4226

critical

Tenable Plugins

low

low

medium

medium

low

low

high

critical

low

low

low