MySQL < 3.23.56 Writable Configuration Files

high Nessus Plugin ID 17820

Language:

Synopsis

The remote host is affected by a privilege escalation vulnerability.

Description

The version of MySQL installed on the remote host is older than 3.23.56. As such, it reportedly creates world-writeable files. By restarting the MySQL daemon under root ID, a local attacker could gain root privileges.

Solution

Upgrade to MySQL 3.23.56 or later.

Plugin Details

Severity: High

ID: 17820

File Name: mysql_3_23_56.nasl

Version: 1.7

Type: remote

Family: Databases

Published: 1/18/2012

Updated: 11/15/2018

Configuration: Enable paranoid mode

Supported Sensors: Frictionless Assessment Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:mysql:mysql

Required KB Items: Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 3/8/2003

Reference Information

CVE: CVE-2003-0150

BID: 7052

CERT: 203897

Detections

Analytics