Vulnerability Description
MySQL Community Server 5.0.x before 5.0.51, Enterprise Server 5.0.x before 5.0.52, Server 5.1.x before 5.1.23, and Server 6.0.x before 6.0.4, when a table relies on symlinks created through explicit DATA DIRECTORY and INDEX DIRECTORY options, allows remote authenticated users to overwrite system table information and gain privileges via a RENAME TABLE statement that changes the symlink to point to an existing file.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mysql | Mysql Server | 5.1.22 |
| Mysql | Community Server | <= 5.0.50 |
| Mysql | Mysql Enterprise Server | 5.0.50 |
Related Weaknesses (CWE)
References
- http://bugs.mysql.com/32111
- http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html
- http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-51.html
- http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-52.html
- http://forums.mysql.com/read.php?3%2C186931%2C186931
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
- http://lists.mysql.com/announce/495ExploitVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
- http://secunia.com/advisories/27981Vendor Advisory
- http://secunia.com/advisories/28025Vendor Advisory
- http://secunia.com/advisories/28040Vendor Advisory
- http://secunia.com/advisories/28063Vendor Advisory
- http://secunia.com/advisories/28099Vendor Advisory
- http://secunia.com/advisories/28108Vendor Advisory
- http://secunia.com/advisories/28128Vendor Advisory
FAQ
What is CVE-2007-5969?
CVE-2007-5969 is a vulnerability with a CVSS score of 7.1 (HIGH). MySQL Community Server 5.0.x before 5.0.51, Enterprise Server 5.0.x before 5.0.52, Server 5.1.x before 5.1.23, and Server 6.0.x before 6.0.4, when a table relies on symlinks created through explicit D...
How severe is CVE-2007-5969?
CVE-2007-5969 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-5969?
Check the references section above for vendor advisories and patch information. Affected products include: Mysql Mysql Server, Mysql Community Server, Mysql Mysql Enterprise Server.