MySQL < 6.0.9-alpha / 5.5.3 Access Control Weakness

medium Nessus Plugin ID 17837

Language:

Synopsis

Access restrictions can be bypassed on the remote database server.

Description

The version of MySQL installed on the remote host is older than 6.0.9-alpha / 5.5.3. As such, it reportedly allows a remote attacker to bypass access restrictions when the data directory contains a symbolic link to a different file system.

Solution

Upgrade to MySQL version 6.0.9-alpha / 5.5.3 or later.

Plugin Details

Severity: Medium

ID: 17837

File Name: mysql_6_0_9.nasl

Version: 1.7

Type: Remote

Family: Databases

Published: 1/18/2012

Updated: 11/15/2018

Configuration: Enable paranoid mode

Supported Sensors: Frictionless Assessment Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:mysql:mysql

Required KB Items: Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 12/8/2008

Vulnerability Publication Date: 11/24/2008

Reference Information

CVE: CVE-2008-7247

BID: 38043

CWE: 59

Detections

Analytics