|
Vulnerabilities in MySQL 8/18/06 |
|
Monday, 21 August 2006 |
MySQL, the popular open-source database management system, has announced the correction of two vulnerabilities in the forthcoming 5.0.25 version.
The first vulnerability would allow a user to access a stored routine using the GRANT EXECUTE command, and execute it with the privileges of the original user that defined the routine.
The second vulnerability affects Linux and other case-sensitive file systems. In this case a user with rights on the database could create or access different databases with the same name as the original, but where one or more letters differ in case. Under certain circumstances, a user can access databases to which they are not authorized.
In both cases the vulnerabilities can only be exploited by users with authenticated access to the system, minimizing the risk of indiscriminate attacks from third parties.
More details about the vulnerabilities and other corrections included in MySQL 5.0.25 are available in the original advisory at: http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
|
Advertises 