CVE-2008-2079: MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a… | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published May 5, 2008

CVE-2008-2079

MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a…

–

CVSS

2.6%

EPSS

No

On KEV

Description

MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.6% · higher than 85% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

MY

MySQL · Oracle

6.0.0 before 6.0.5 · source: NVD

DL

Debian Linux · Debian

4.0 · source: NVD

UL

Ubuntu Linux · Canonical

6.06; 7.10; 8.04 · source: NVD

Affected product

MY

MySQL

Oracle

References

https://nvd.nist.gov/vuln/detail/CVE-2008-2079

https://www.cve.org/CVERecord?id=CVE-2008-2079

http://bugs.mysql.com/bug.php?id=32167

Vendor Advisory

http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html

Vendor Advisory

http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-60.html

Vendor Advisory

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-24.html

Vendor Advisory

http://dev.mysql.com/doc/refman/6.0/en/news-6-0-5.html

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

More from MySQL

9.8

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement

9.8

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10

9.8

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation

9.8

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic

9.8

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before…