CVE-2006-4227

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://bugs.mysql.com/bug.php?id=18630	Exploit
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
http://lists.mysql.com/commits/7918
http://secunia.com/advisories/21506	Vendor Advisory
http://secunia.com/advisories/21770	Vendor Advisory
http://secunia.com/advisories/22080	Vendor Advisory
http://secunia.com/advisories/30351	Vendor Advisory
http://securitytracker.com/id?1016709
http://www.novell.com/linux/security/advisories/2006_23_sr.html
http://www.redhat.com/support/errata/RHSA-2007-0083.html	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2008-0364.html	Vendor Advisory
http://www.securityfocus.com/bid/19559	Exploit
http://www.ubuntu.com/usn/usn-338-1
http://www.vupen.com/english/advisories/2006/3306	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28442
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10105

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mysql:mysql:5.0.1:::::::*
	cpe:2.3:a:mysql:mysql:5.0.2:::::::*
	cpe:2.3:a:mysql:mysql:5.0.3:::::::*
	cpe:2.3:a:mysql:mysql:5.0.4:::::::*
	cpe:2.3:a:mysql:mysql:5.0.20:::::::*
	cpe:2.3:a:mysql:mysql:5.0.22.1.0.1:::::::*
	cpe:2.3:a:mysql:mysql:5.0.24:::::::*
	cpe:2.3:a:mysql:mysql:5.1.5:::::::*
	cpe:2.3:a:oracle:mysql:5.0.0:alpha::::::
	cpe:2.3:a:oracle:mysql:5.1.6:::::::*
	cpe:2.3:a:oracle:mysql:5.1.9:::::::*
	cpe:2.3:a:oracle:mysql:5.1.10:::::::*

History

No history.

Information

Published : 2006-08-18 20:04

Updated : 2023-12-10 10:28

NVD link : CVE-2006-4227

Mitre link : CVE-2006-4227

CVE.ORG link : CVE-2006-4227

JSON object : View

Products Affected

oracle

mysql

mysql

mysql

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2006-4227", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-08-18T20:04:00.000", "references": [{"url": "http://bugs.mysql.com/bug.php?id=18630", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html", "source": "cve@mitre.org"}, {"url": "http://lists.mysql.com/commits/7918", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/21506", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/21770", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/22080", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/30351", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1016709", "source": "cve@mitre.org"}, {"url": "http://www.novell.com/linux/security/advisories/2006_23_sr.html", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2007-0083.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2008-0364.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/19559", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.ubuntu.com/usn/usn-338-1", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/3306", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28442", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10105", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE."}, {"lang": "es", "value": "MySQL anterior a 5.0.25 y 5.1 anterior a 5.1.12 eval\u00faa los argumentos de rutinas suid en el contexto de seguridad del creador de la rutina en lugar del de aquel que llama a la rutina, lo que permite a usuarios autenticados remotamente escalar privilegios a trav\u00e9s de una rutina que ha sido puesta a su disposici\u00f3n utilizando GRANT EXECUTE."}], "lastModified": "2019-12-17T20:05:22.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B77A2761-2B44-4061-9C29-A54F90A1AD83"}, {"criteria": "cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B3AD851-056F-4E57-B85B-4AC5A5A20C0C"}, {"criteria": "cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD24EA8C-4FCA-4F40-B2EA-7DFA49432483"}, {"criteria": "cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "754B78F2-A03C-40BE-812B-F5E57B93D20B"}, {"criteria": "cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "665E063D-355D-4A5A-A05F-36BF582DE36F"}, {"criteria": "cpe:2.3:a:mysql:mysql:5.0.22.1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "214E3CF9-6362-4F5A-91B7-5E69564F7144"}, {"criteria": "cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4C6CD84-EA5D-451F-AFC3-5F7094F0017D"}, {"criteria": "cpe:2.3:a:mysql:mysql:5.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35BED939-3366-4CBF-B6BF-29C0C42E97F7"}, {"criteria": "cpe:2.3:a:oracle:mysql:5.0.0:alpha:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19001041-22C4-4D2C-A918-378DACBB1DF4"}, {"criteria": "cpe:2.3:a:oracle:mysql:5.1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88FEEE64-899F-4F55-B829-641706E29E32"}, {"criteria": "cpe:2.3:a:oracle:mysql:5.1.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EB2323C-EFE2-407A-9AE9-8717FA9F8625"}, {"criteria": "cpe:2.3:a:oracle:mysql:5.1.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6341F695-6034-4CC1-9485-ACD3A0E1A079"}], "operator": "OR"}]}], "vendorComments": [{"comment": "This issue did not affect the versions of MySQL as shipped with Red Hat Enterprise Linux 2.1, 3, or 4.\n\nIssue was addressed in MySQL packages as shipped in Red Hat Enterprise Linux 5 via:\n\nhttps://rhn.redhat.com/errata/RHSA-2008-0364.html", "lastModified": "2008-07-25T00:00:00", "organization": "Red Hat"}], "sourceIdentifier": "cve@mitre.org"}