National Vulnerability Database (NVD) National Vulnerability Database (CVE-2007-2692)

National Cyber Awareness System

Vulnerability Summary for CVE-2007-2692

Original release date:05/16/2007

Last revised:11/06/2012

Source: US-CERT/NIST

Overview

The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:6.0 (MEDIUM) (AV:N/AC:M/Au:S/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 6.8

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Medium

Authentication: Required to exploit

Impact Type:Provides unauthorized access, Allows partial confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (07/25/2008)

This issue did not affect mysql packages as shipped in Red Hat Enterprise Linux 2.1, 3 and 4. Affected mysql packages as shipped in Red Hat Enterprise Linux 5 and Red Hat Application Stack were fixed via: https://rhn.redhat.com/errata/CVE-2007-2692.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2007-1804

Hyperlink:http://www.vupen.com/english/advisories/2007/1804

External Source: SECTRACK

Name: 1018070

Hyperlink:http://www.securitytracker.com/id?1018070

External Source: BID

Name: 24011

Hyperlink:http://www.securityfocus.com/bid/24011

External Source: REDHAT

Name: RHSA-2008:0364

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0364.html

External Source: SECUNIA

Name: 30351

Hyperlink:http://secunia.com/advisories/30351

External Source: SECUNIA

Name: 25301

Type: Advisory

Hyperlink:http://secunia.com/advisories/25301

External Source: OVAL

Name: oval:org.mitre.oval:def:9166

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9166

External Source: OSVDB

Name: 34765

Hyperlink:http://osvdb.org/34765

External Source: CONFIRM

Name: http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html

Hyperlink:http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html

External Source: MISC

Name: http://bugs.mysql.com/bug.php?id=27337

Hyperlink:http://bugs.mysql.com/bug.php?id=27337

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1536

Hyperlink:https://issues.rpath.com/browse/RPL-1536

External Source: XF

Name: mysql-changedb-privilege-escalation(34348)

Hyperlink:http://xforce.iss.net/xforce/xfdb/34348

External Source: UBUNTU

Name: USN-588-1

Hyperlink:http://www.ubuntu.com/usn/usn-588-1

External Source: BUGTRAQ

Name: 20070717 rPSA-2007-0143-1 mysql mysql-bench mysql-server

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/473874/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:0894

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0894.html

External Source: MANDRIVA

Name: MDVSA-2008:028

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:028

External Source: DEBIAN

Name: DSA-1413

Hyperlink:http://www.debian.org/security/2007/dsa-1413

External Source: SECUNIA

Name: 29443

Hyperlink:http://secunia.com/advisories/29443

External Source: SECUNIA

Name: 28838

Hyperlink:http://secunia.com/advisories/28838

External Source: SECUNIA

Name: 28637

Hyperlink:http://secunia.com/advisories/28637

External Source: SECUNIA

Name: 27823

Hyperlink:http://secunia.com/advisories/27823

External Source: SECUNIA

Name: 26430

Hyperlink:http://secunia.com/advisories/26430

External Source: SECUNIA

Name: 26073

Hyperlink:http://secunia.com/advisories/26073

External Source: SUSE

Name: SUSE-SR:2008:003

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html

External Source: MLIST

Name: [announce] 20070712 MySQL Community Server 5.0.45 has been released!

Hyperlink:http://lists.mysql.com/announce/470

References to Check Content

Identifier:oval:org.mitre.oval:def:9166

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9166

Vulnerable software and versions

Configuration 1

* cpe:/a:mysql:mysql:5.0.0

* cpe:/a:mysql:mysql:5.0.0.0

* cpe:/a:mysql:mysql:5.0.0:alpha

* cpe:/a:mysql:mysql:5.0.1

* cpe:/a:mysql:mysql:5.0.10

* cpe:/a:mysql:mysql:5.0.10a

* cpe:/a:mysql:mysql:5.0.11

* cpe:/a:mysql:mysql:5.0.12

* cpe:/a:mysql:mysql:5.0.13

* cpe:/a:mysql:mysql:5.0.14

* cpe:/a:mysql:mysql:5.0.15

* cpe:/a:mysql:mysql:5.0.15a

* cpe:/a:mysql:mysql:5.0.16

* cpe:/a:mysql:mysql:5.0.16a

* cpe:/a:mysql:mysql:5.0.17

* cpe:/a:mysql:mysql:5.0.17a

* cpe:/a:mysql:mysql:5.0.18

* cpe:/a:mysql:mysql:5.0.19

* cpe:/a:mysql:mysql:5.0.1a

* cpe:/a:mysql:mysql:5.0.2

* cpe:/a:mysql:mysql:5.0.20

* cpe:/a:mysql:mysql:5.0.20a

* cpe:/a:mysql:mysql:5.0.21

* cpe:/a:mysql:mysql:5.0.22

* cpe:/a:mysql:mysql:5.0.22.1.0.1

* cpe:/a:mysql:mysql:5.0.24

* cpe:/a:mysql:mysql:5.0.27

* cpe:/a:mysql:mysql:5.0.3

* cpe:/a:mysql:mysql:5.0.3:beta

* cpe:/a:mysql:mysql:5.0.33

* cpe:/a:mysql:mysql:5.0.37

* cpe:/a:mysql:mysql:5.0.3a

* cpe:/a:mysql:mysql:5.0.4

* cpe:/a:mysql:mysql:5.0.4a

* cpe:/a:mysql:mysql:5.0.5

* cpe:/a:mysql:mysql:5.0.5.0.21

* cpe:/a:mysql:mysql:5.0.6

* cpe:/a:mysql:mysql:5.0.7

* cpe:/a:mysql:mysql:5.0.8

* cpe:/a:mysql:mysql:5.0.9

* cpe:/a:mysql:mysql:5.1.1

* cpe:/a:mysql:mysql:5.1.10

* cpe:/a:mysql:mysql:5.1.11

* cpe:/a:mysql:mysql:5.1.12

* cpe:/a:mysql:mysql:5.1.13

* cpe:/a:mysql:mysql:5.1.14

* cpe:/a:mysql:mysql:5.1.15

* cpe:/a:mysql:mysql:5.1.16

* cpe:/a:mysql:mysql:5.1.17

* cpe:/a:mysql:mysql:5.1.2

* cpe:/a:mysql:mysql:5.1.3

* cpe:/a:mysql:mysql:5.1.4

* cpe:/a:mysql:mysql:5.1.5

* cpe:/a:mysql:mysql:5.1.6

* cpe:/a:mysql:mysql:5.1.7

* cpe:/a:mysql:mysql:5.1.8

* cpe:/a:mysql:mysql:5.1.9

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2692