search menu icon-carat-right cmu-wordmark

CERT Coordination Center

MySQL allows default user to be changed to root via custom "my.cnf" file

Vulnerability Note VU#203897

Original Release Date: 2003-03-18 | Last Revised: 2003-03-20

Overview

MySQL reads configuration options from world-writeable files. This can lead to a remote user gaining elevated privileges.

Description

A message posted to the bugtraq mailing list details a vulnerability affecting versions of MySQL prior to 3.23.56. MySQL would permit users with 'FILE' permissions to create and edit world-writeable configuration files. Upon rebooting the server, MySQL would read these files and be configured to give a remote user elevated privileges.

Impact

Exploitation of this vulnerability can lead to a remote user gaining elevated privileges and subsequently gaining control of the MySQL database.

Solution

Version 3.23.56 of MySQL resolves this issue. Likewise, you may apply the patch or upgrade supplied by your vendor for this issue.

Vendor Information

203897
 

CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

Thanks to Gufino for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

CVE IDs: CVE-2003-0150
Severity Metric: 9.43
Date Public: 2003-03-08
Date First Published: 2003-03-18
Date Last Updated: 2003-03-20 16:12 UTC
Document Revision: 8

Sponsored by CISA.