NetSight
IP …
medium4.4

CVE-2009-4030

MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (…

Impact

MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.

Affected products

VendorProductAffected versions
MysqlMysql
Versions 5.1.5, 5.1.23, 5.1.32
OracleMysql
Versions 5.1, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.6

Weakness classification

CWE-59

References