CVE-2010-2008
13.07.2010, 20:30
MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory.
| Vendor | Product | Version |
|---|---|---|
| oracle | mysql | 𝑥 < 5.1.48 |
| canonical | ubuntu_linux | 6.06 |
| canonical | ubuntu_linux | 8.04 |
| canonical | ubuntu_linux | 9.10 |
| canonical | ubuntu_linux | 10.04 |
| canonical | ubuntu_linux | 10.10 |
| canonical | ubuntu_linux | 11.04 |
| canonical | ubuntu_linux | 11.10 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Ubuntu Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| mysql-5.1 |
| ||||||||||||
| mysql-dfsg-4.1 |
| ||||||||||||
| mysql-dfsg-5.0 |
| ||||||||||||
| mysql-dfsg-5.1 |
|
References