CVE-2009-4030
Published: 30 November 2009
MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
Notes
| Author | Note |
|---|---|
| mdeslaur | actually made it in 5.1.42 |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
mysql-5.1 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Does not exist
|
|
| jaunty |
Does not exist
|
|
| karmic |
Does not exist
|
|
| lucid |
Does not exist
|
|
| maverick |
Released
(5.1.41-3ubuntu7)
|
|
| natty |
Released
(5.1.41-3ubuntu7)
|
|
| upstream |
Needs triage
|
|
|
mysql-dfsg Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
| hardy |
Does not exist
|
|
| intrepid |
Does not exist
|
|
| jaunty |
Does not exist
|
|
| karmic |
Does not exist
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
mysql-dfsg-4.1 Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
| hardy |
Does not exist
|
|
| intrepid |
Does not exist
|
|
| jaunty |
Does not exist
|
|
| karmic |
Does not exist
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
mysql-dfsg-5.0 Launchpad, Ubuntu, Debian |
dapper |
Released
(5.0.22-0ubuntu6.06.12)
|
| hardy |
Released
(5.0.51a-3ubuntu5.5)
|
|
| intrepid |
Released
(5.0.67-0ubuntu6.1)
|
|
| jaunty |
Released
(5.1.30really5.0.75-0ubuntu10.3)
|
|
| karmic |
Ignored
(end of life)
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
mysql-dfsg-5.1 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Does not exist
|
|
| intrepid |
Does not exist
|
|
| jaunty |
Ignored
(end of life)
|
|
| karmic |
Released
(5.1.37-1ubuntu5.1)
|
|
| lucid |
Released
(5.1.41-3ubuntu7)
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
Patches: upstream: http://lists.mysql.com/commits/89940 |
||