Vulnerabilities > CVE-2007-6303 - Privilege Escalation And Denial Of Service vulnerability in MySQL Server

047910
CVSS 3.5 - LOW
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
SINGLE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
mysql
oracle
nessus
NVD
Published: 2007-12-10
Updated: 2019-12-17

Summary

MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement.

Vulnerable Configurations

Part Description Count
Application
Mysql
14
Application
Oracle
15

Nessus

  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-588-1.NASL
    descriptionMasaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232) Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges. This issue does not affect Ubuntu 7.10. (CVE-2007-2692) Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303) Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id31638
    published2008-03-21
    reporterUbuntu Security Notice (C) 2008-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/31638
    titleUbuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mysql-dfsg-5.0 vulnerabilities (USN-588-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-588-2.NASL
    descriptionUSN-588-1 fixed vulnerabilities in MySQL. In fixing CVE-2007-2692 for Ubuntu 6.06, additional improvements were made to make privilege checks more restictive. As a result, an upstream bug was exposed which could cause operations on tables or views in a different database to fail. This update fixes the problem. We apologize for the inconvenience. Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232) Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges. This issue does not affect Ubuntu 7.10. (CVE-2007-2692) Martin Friebe discovered that MySQL did not properly update the DEFINER value of an altered view. An authenticated user could use CREATE SQL SECURITY DEFINER VIEW and ALTER VIEW statements to gain privileges. (CVE-2007-6303) Luigi Auriemma discovered that yaSSL as included in MySQL did not properly validate its input. A remote attacker could send crafted requests and cause a denial of service or possibly execute arbitrary code. This issue did not affect Ubuntu 6.06 in the default installation. (CVE-2008-0226, CVE-2008-0227). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id31783
    published2008-04-04
    reporterUbuntu Security Notice (C) 2008-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/31783
    titleUbuntu 6.06 LTS : mysql-dfsg-5.0 regression (USN-588-2)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2007-1157.NASL
    descriptionThe remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-1157.
    last seen2020-06-01
    modified2020-06-02
    plugin id29752
    published2007-12-24
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29752
    titleCentOS 4 : mysql (CESA-2007:1222-001)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_MYSQL-4879.NASL
    descriptionThis update fixes several security vulnerabilities (note: not all versions are affected by every bug) : - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304
    last seen2020-06-01
    modified2020-06-02
    plugin id30182
    published2008-02-05
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/30182
    titleSuSE 10 Security Update : MySQL (ZYPP Patch Number 4879)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200804-04.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200804-04 (MySQL: Multiple vulnerabilities) Multiple vulnerabilities have been reported in MySQL: Mattias Jonsson reported that a
    last seen2020-06-01
    modified2020-06-02
    plugin id31835
    published2008-04-11
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31835
    titleGLSA-200804-04 : MySQL: Multiple vulnerabilities
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2008-028.NASL
    descriptionThe mysql_change_db() function in MySQL 5.0.x before 5.0.40 did not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allowed remote authenticated users to gain privileges (CVE-2007-2692). The federated engine in MySQL 5.0.x, when performing a certain SHOW TABLE STATUS query, did not properly handle a response with a small number of columns, which could allow a remote MySQL server to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns (CVE-2007-6304). The updated packages provide MySQL 5.0.45 for all Mandriva Linux platforms that shipped with MySQL 5.0.x which offers a number of feature enhancements and bug fixes. In addition, the updates for Corporate Server 4.0 include support for the Sphinx engine. Please note that due to the package name change (from
    last seen2020-06-01
    modified2020-06-02
    plugin id36399
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/36399
    titleMandriva Linux Security Advisory : mysql (MDVSA-2008:028)
  • NASL familyDatabases
    NASL idMYSQL_6_0_4.NASL
    descriptionThe version of MySQL installed on the remote host is earlier than 5.0.51a / 5.1.23 / 6.0.4 and thus reportedly affected by the following two vulnerabilities : - An attacker may be able to cause the federated handler and daemon to crash when the federated engine issues a SHOW TABLE STATUS LIKE query by having a malicious server return a response with less than 14 columns. (MySQL bug #29801 / CVE-2007-6304) - It fails to update the DEFINER value of a view when that is altered, which could allow an authenticated user to gain additional access through the ALTER VIEW. (MySQL bug #29908 / CVE-2007-6303)
    last seen2020-06-01
    modified2020-06-02
    plugin id17813
    published2012-01-16
    reporterThis script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/17813
    titleMySQL < 5.0.51a / 5.1.23 / 6.0.4 Multiple Vulnerabilities
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2008-017.NASL
    descriptionMySQL 5.0.x did not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement (CVE-2007-6303). The federated engine in MySQL 5.0.x, when performing a certain SHOW TABLE STATUS query, did not properly handle a response with a small number of columns, which could allow a remote MySQL server to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns (CVE-2007-6304). The updated packages have been patched to correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id36404
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/36404
    titleMandriva Linux Security Advisory : mysql (MDVSA-2008:017)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2007-4465.NASL
    description - Thu Dec 13 2007 Tom Lane <tgl at redhat.com> 5.0.45-6 - Back-port upstream fixes for CVE-2007-5925, CVE-2007-5969, CVE-2007-6303. Related: #422211 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id29712
    published2007-12-17
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29712
    titleFedora 8 : mysql-5.0.45-6.fc8 (2007-4465)
  • NASL familyF5 Networks Local Security Checks
    NASL idF5_BIGIP_SOL8178.NASL
    descriptionInformation about these advisories is available at the following locations :
    last seen2020-06-01
    modified2020-06-02
    plugin id78218
    published2014-10-10
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/78218
    titleF5 Networks BIG-IP : MySQL vulnerabilities (SOL8178)
  • NASL familySuSE Local Security Checks
    NASL idSUSE9_12044.NASL
    descriptionThis update fixes several security vulnerabilities (note: not all versions are affected by every bug) : - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304
    last seen2020-06-01
    modified2020-06-02
    plugin id41184
    published2009-09-24
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/41184
    titleSuSE9 Security Update : MySQL (YOU Patch Number 12044)
  • NASL familyDatabases
    NASL idMYSQL_ENTERPRISE_5_0_52.NASL
    descriptionThe version of MySQL Enterprise Server 5.0 installed on the remote host is earlier than 5.0.52. Such versions reportedly are affected by the following issues : - Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information. (Bug #32111). - ALTER VIEW retained the original DEFINER value, even when altered by another user, which could allow that user to gain the access rights of the view. (Bug #29908) - When using a FEDERATED table, the local server can be forced to crash if the remote server returns a result with fewer columns than expected. (Bug #29801)
    last seen2020-06-01
    modified2020-06-02
    plugin id29346
    published2007-12-13
    reporterThis script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29346
    titleMySQL Enterprise Server 5.0 < 5.0.52 Multiple Vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2007-4471.NASL
    description - Thu Dec 13 2007 Tom Lane <tgl at redhat.com> 5.0.45-6 - Back-port upstream fixes for CVE-2007-5925, CVE-2007-5969, CVE-2007-6303. Related: #422211 - Update License tag to match code. - Sun Jul 22 2007 Tom Lane <tgl at redhat.com> 5.0.45-1 - Update to MySQL 5.0.45 Resolves: #246535 - Move mysql_config
    last seen2020-06-01
    modified2020-06-02
    plugin id29714
    published2007-12-17
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29714
    titleFedora 7 : mysql-5.0.45-6.fc7 (2007-4471)
  • NASL familyDatabases
    NASL idMYSQL_5_1_23.NASL
    descriptionThe version of MySQL Server installed on the remote host reportedly is affected by the following issues : - It is possible, by creating a partitioned table using the DATA DIRECTORY and INDEX DIRECTORY options, to gain privileges on other tables having the same name as the partitioned table. (Bug #32091) - Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information. (Bug #32111). - ALTER VIEW retains the original DEFINER value, even when altered by another user, which can allow that user to gain the access rights of the view. (Bug #29908) - When using a FEDERATED table, the local server can be forced to crash if the remote server returns a result with fewer columns than expected. (Bug #29801)
    last seen2020-06-01
    modified2020-06-02
    plugin id29345
    published2007-12-13
    reporterThis script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29345
    titleMySQL Community Server < 5.1.23 / 6.0.4 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_LIBMYSQLCLIENT-DEVEL-4873.NASL
    descriptionThis update fixes several security vulnerabilities (note: not all versions are affected by every bug) : - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304
    last seen2020-06-01
    modified2020-06-02
    plugin id30180
    published2008-02-05
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/30180
    titleopenSUSE 10 Security Update : libmysqlclient-devel (libmysqlclient-devel-4873)

Redhat

advisories
rhsa
idRHSA-2007:1157
rpms
  • mysql-0:5.0.44-2.el4s1.1
  • mysql-0:5.0.44-3.el5s2
  • mysql-bench-0:5.0.44-2.el4s1.1
  • mysql-bench-0:5.0.44-3.el5s2
  • mysql-cluster-0:5.0.44-2.el4s1.1
  • mysql-cluster-0:5.0.44-3.el5s2
  • mysql-debuginfo-0:5.0.44-2.el4s1.1
  • mysql-debuginfo-0:5.0.44-3.el5s2
  • mysql-devel-0:5.0.44-2.el4s1.1
  • mysql-devel-0:5.0.44-3.el5s2
  • mysql-libs-0:5.0.44-2.el4s1.1
  • mysql-libs-0:5.0.44-3.el5s2
  • mysql-server-0:5.0.44-2.el4s1.1
  • mysql-server-0:5.0.44-3.el5s2
  • mysql-test-0:5.0.44-2.el4s1.1
  • mysql-test-0:5.0.44-3.el5s2

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 26832&lt;br /&gt; CVE(CAN) ID: CVE-2007-6303,CVE-2007-6304&lt;br /&gt; &lt;br /&gt; MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。&lt;br /&gt; &lt;br /&gt; 在视图已经更改时MySQL没有更新视图的DEFINER值，这允许已认证的远程攻击者通过一系列的CREATE SQL SECURITY DEFINER VIEW和ALTER VIEW语句获得权限提升。 &lt;br /&gt; &lt;br /&gt; MySQL的federated引擎在执行某些SHOW TABLE STATUS查询时没有正确地处理少量列数的响应，如果响应缺少必须的最少列数的话，就可能导致远程MySQL服务器崩溃。&lt;br /&gt; MySQL AB MySQL 6.0.x MySQL AB MySQL 5.1.x MySQL AB MySQL 5.0.x 临时解决方法： * 使用mysql_num_fields()判断查询是否返回了预期的列数。 厂商补丁： MySQL AB -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=http://www.mysql.com/ target=_blank>http://www.mysql.com/</a>
idSSV:2606
last seen2017-11-19
modified2007-12-14
published2007-12-14
reporterRoot
titleMySQL Server权限提升及拒绝服务漏洞

Statements

contributorMark J Cox
lastmodified2008-01-09
organizationRed Hat
statementThis issue did not affect the mysql packages as shipped in Red Hat Enterprise Linux 2.1, 3, 4, or 5. This issue affected the mysql packages as shipped in Red Hat Application Stack v1 and v2 and was addressed by RHSA-2007:1157: http://rhn.redhat.com/errata/RHSA-2007-1157.html

References