NetSight
IP …
high7.5Public exploit code

CVE-2004-0835

MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the tar…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation, which could allow attackers to conduct unauthorized activities.

Affected products

VendorProductAffected versions
MysqlMysql
from 4.1.0 through 4.1.2
from 5.0.0 through 5.0.1
OracleMysql
after 3.20 before 3.23.59
from 4.0.0 before 4.0.19
DebianDebian Linux
Version 3.0

References