CVE-2010-2008

Oracle MySQL - 'ALTER DATABASE' Remote Denial of Service

Severity Score

3.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory.

MySQL anterior a v5.1.48 permite a usuarios autenticados remotamente con privilegios de modificación en la base de datos provocar una denegación de servicio (caída de servidor y pérdida de la base de datos) a través del comando "ALTER DATABASE" con una cadena #mysql50# seguida de un ..(punto punto), ../ (punto punto barra) o secuencia similar, y un comando "UPGRADE DATA DIRECTORY NAME", lo que provoca que MySQL mueva ciertos directorios al directorio del servidor de datos.

*Credits: N/A

CVSS Scores

NISTv2 3.5

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-05-21 CVE Reserved
2010-07-13 CVE Published
2010-08-03 First Exploit
2024-07-15 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

CAPEC

References (12)

URL	Tag	Source
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-48.html	Broken Link
http://secunia.com/advisories/40333	Third Party Advisory
http://secunia.com/advisories/40762	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11869	Signature

URL	Date	SRC
https://www.exploit-db.com/exploits/14537	2010-08-03
http://bugs.mysql.com/bug.php?id=53804	2024-08-07
http://www.securityfocus.com/bid/41198	2024-08-07
http://www.securitytracker.com/id?1024160	2024-08-07

URL	Date	SRC

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044546.html	2020-11-09
http://www.mandriva.com/security/advisories?name=MDVSA-2010:155	2020-11-09
http://www.ubuntu.com/usn/USN-1017-1	2020-11-09
http://www.ubuntu.com/usn/USN-1397-1	2020-11-09

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Oracle Search vendor "Oracle"		Mysql Search vendor "Oracle" for product "Mysql"				< 5.1.48 Search vendor "Oracle" for product "Mysql" and version " < 5.1.48"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				6.06 Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				8.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "8.04"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				9.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "9.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				10.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "10.04"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				10.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "10.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				11.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "11.04"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				11.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "11.10"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				13 Search vendor "Fedoraproject" for product "Fedora" and version "13"		-		Affected