OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[SA12327] MySQL mysqlhotcopy Insecure Temporary File Creation Vulnerability

From: Secunia Security Advisories (sec-advsecunia.com)
Date: Thu Aug 19 2004 - 05:50:52 CDT

TITLE:
MySQL mysqlhotcopy Insecure Temporary File Creation Vulnerability

SECUNIA ADVISORY ID:
SA12327

VERIFY ADVISORY:
http://secunia.com/advisories/12327/

CRITICAL:
Less critical

IMPACT:
Privilege escalation

WHERE:
Local system

SOFTWARE:
MySQL 3.x
http://secunia.com/product/99/
MySQL 4.x
http://secunia.com/product/404/

DESCRIPTION:
Jeroen van Wolffelaar has discovered a vulnerability in MySQL,
potentially allowing malicious users to overwrite arbitrary files.

The copy utility "mysqlhotcopy" creates a file with an easy guessable
name in an insecure manner if the scp (secure copy) method is used.
This can potentially be exploited by malicious users to overwrite
arbitrary files when "mysqlhotcopy" is executed by a privileged
user.

This has been reported in the MySQL 4.0.20 and prior including the
MySQL 3 branch.

SOLUTION:
Do not use the "mysqlhotcopy" utility on systems with untrusted
users.

PROVIDED AND/OR DISCOVERED BY:
Jeroen van Wolffelaar

ORIGINAL ADVISORY:
http://www.debian.org/security/2004/dsa-540

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------