Detections
Analytics
Oracle MySQL < 4.0.21 Remote GRANT Privilege Escalation
medium Nessus Network Monitor Plugin ID 2370
Synopsis
The remote host is vulnerable to a flaw that allows attackers to retrieve sensitive files or data.Description
The remote host is running a version of MySQL that is older than version 4.0.21.It is vulnerable to a flaw that may allow an attacker to gain access to unauthorized databases. An attacker can exploit this vulnerability if he has GRANT privileges on databases containing '_'.
Solution
Upgrade to version 4.0.21 or higher.See Also
http://bugs.mysql.com/bug.php?id=3870
http://www.novell.com/linux/security/securitysupport.html
http://www.gentoo.org/security/en/glsa/glsa-200410-22.xml
http://www.debian.org/security/2005/dsa-707
http://www.ubuntulinux.org/usn/usn-109-1
Plugin Details
Severity: Medium
ID: 2370
Family: Database
Published: 10/28/2004
Updated: 3/6/2019
Nessus ID: 15477
Risk Information
VPR
Risk Factor: Medium
Score: 5.5
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 5.6
Temporal Score: 5.4
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mysql:mysql
Reference Information
CVE: CVE-2004-0957