CVE-2006-4227

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.mysql.com/commits/7918
http://bugs.mysql.com/bug.php?id=18630	Exploit
http://www.securityfocus.com/bid/19559	Exploit
http://secunia.com/advisories/21506	Vendor Advisory
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
http://securitytracker.com/id?1016709
http://www.ubuntu.com/usn/usn-338-1
http://secunia.com/advisories/21770	Vendor Advisory
http://www.novell.com/linux/security/advisories/2006_23_sr.html
http://secunia.com/advisories/22080	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-0083.html	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2008-0364.html	Vendor Advisory
http://secunia.com/advisories/30351	Vendor Advisory
http://www.vupen.com/english/advisories/2006/3306	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28442
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10105

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:mysql:5.0.0:alpha::::::
	cpe:2.3:a:mysql:mysql:5.0.1:::::::*
	cpe:2.3:a:mysql:mysql:5.0.24:::::::*
	cpe:2.3:a:mysql:mysql:5.0.3:::::::*
	cpe:2.3:a:mysql:mysql:5.0.4:::::::*
	cpe:2.3:a:mysql:mysql:5.0.22.1.0.1:::::::*
	cpe:2.3:a:oracle:mysql:5.1.10:::::::*
	cpe:2.3:a:mysql:mysql:5.1.5:::::::*
	cpe:2.3:a:mysql:mysql:5.0.2:::::::*
	cpe:2.3:a:mysql:mysql:5.0.20:::::::*
	cpe:2.3:a:oracle:mysql:5.1.6:::::::*
	cpe:2.3:a:oracle:mysql:5.1.9:::::::*

Information

Published : 2006-08-18 13:04

Updated : 2019-12-17 12:05

NVD link : CVE-2006-4227

Mitre link : CVE-2006-4227

JSON object : View

CWE

CWE-20

Improper Input Validation

Advertisement

Products Affected

oracle

mysql

mysql

mysql

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://lists.mysql.com/commits/7918", "name": "[commits] 20060620 bk commit into 5.0 tree (kroki:1.2168) BUG#18630", "tags": [], "refsource": "MLIST"}, {"url": "http://bugs.mysql.com/bug.php?id=18630", "name": "http://bugs.mysql.com/bug.php?id=18630", "tags": ["Exploit"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/19559", "name": "19559", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/21506", "name": "21506", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html", "name": "http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html", "tags": [], "refsource": "CONFIRM"}, {"url": "http://securitytracker.com/id?1016709", "name": "1016709", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.ubuntu.com/usn/usn-338-1", "name": "USN-338-1", "tags": [], "refsource": "UBUNTU"}, {"url": "http://secunia.com/advisories/21770", "name": "21770", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.novell.com/linux/security/advisories/2006_23_sr.html", "name": "SUSE-SR:2006:023", "tags": [], "refsource": "SUSE"}, {"url": "http://secunia.com/advisories/22080", "name": "22080", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.redhat.com/support/errata/RHSA-2007-0083.html", "name": "RHSA-2007:0083", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.redhat.com/support/errata/RHSA-2008-0364.html", "name": "RHSA-2008:0364", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://secunia.com/advisories/30351", "name": "30351", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2006/3306", "name": "ADV-2006-3306", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28442", "name": "mysql-grant-execute-privilege-escalation(28442)", "tags": [], "refsource": "XF"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10105", "name": "oval:org.mitre.oval:def:10105", "tags": [], "refsource": "OVAL"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-4227", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2006-08-18T20:04Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:oracle:mysql:5.0.0:alpha:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mysql:mysql:5.0.22.1.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:oracle:mysql:5.1.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mysql:mysql:5.1.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:oracle:mysql:5.1.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:oracle:mysql:5.1.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2019-12-17T20:05Z"}