NVD - CVE-2008-4098

CVE-2008-4098 Detail

Modified

This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.

Current Description

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.

Source: MITRE
Description Last Modified: 09/18/2008
View Analysis Description

Impact

CVSS v2.0 Severity and Metrics:

Base Score: 4.6 MEDIUM
Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:P) (V2 legend)
Impact Subscore: 6.4
Exploitability Subscore: 3.9

Access Vector (AV): Network
Access Complexity (AC): High
Authentication (AU): Single
Confidentiality (C): Partial
Integrity (I): Partial
Availability (A): Partial
Additional Information:
Provides unauthorized access
Allows unauthorized disclosure of information
Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (02/17/2010)

This issue was addressed in Red Hat Enterprise Linux 4 via https://rhn.redhat.com/errata/RHSA-2010-0110.html and in Red Hat Application Stack v2 via https://rhn.redhat.com/errata/RHSA-2009-1067.html . In Red Hat Enterprise Linux 5, issue CVE-2008-2079 was fixed without introducing CVE-2008-4098 in https://rhn.redhat.com/errata/RHSA-2009-1289.html .

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25	Issue Tracking Third Party Advisory
http://bugs.mysql.com/bug.php?id=32167	Issue Tracking Patch Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html	Third Party Advisory
http://ubuntu.com/usn/usn-897-1	Third Party Advisory
http://www.debian.org/security/2008/dsa-1662	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:094	Broken Link
http://www.openwall.com/lists/oss-security/2008/09/09/20	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/09/16/3	Mailing List Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-1067.html	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0110.html	Third Party Advisory
http://www.ubuntu.com/usn/USN-1397-1
http://www.ubuntu.com/usn/USN-671-1	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/45649
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10591

References to Check Content

Identifier:: oval:org.mitre.oval:def:10591
Check System:: http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:: http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10591

Technical Details

Vulnerability Type (View All)

Link Following (CWE-59)

Vulnerable software and versions Switch to CPE 2.2

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

5 change records found - show changes

Modified Analysis - 8/3/2017 2:07:48 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 3246 characters. View Entire Change Record OR cpe:2.3:a:mysql:mysql:5.0.0::::::: cpe:2.3:a:mysql:mysql:5.0.1::::::: cpe:2.3:a:mysql:mysql:5.0.2::::::: cpe:2.3:a:mysql:mysql:5.0.3::::::: cpe:2.3:a:mysql:mysql:5.0.4::::::: cpe:2.3:a:mysql:mysql:5.0.5::::::: cpe:2.3:a:mysql:mysql:5.0.6::::::: cpe:2.3:a:mysql:mysql:5.0.7::::::: cpe:2.3:a:mysql:mysql:5.0.8::::::: cpe:2.3:a:mysql:mysql:5.0.9::::::: *cpe:2.3:a:m
Added	CPE Configuration		OR cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts:::* cpe:2.3:o:canonical:ubuntu_linux:7.10::::::: cpe:2.3:o:canonical:ubuntu_linux:8.04::::lts:::* cpe:2.3:o:canonical:ubuntu_linux:8.10::::::: cpe:2.3:o:canonical:ubuntu_linux:9.04::::::: cpe:2.3:o:canonical:ubuntu_linux:9.10:::::::
Changed	CPE Configuration	Record truncated, showing 500 of 9797 characters. View Entire Change Record OR cpe:2.3:a:mysql:mysql::::::::* cpe:2.3:a:mysql:mysql:3.20::::::: cpe:2.3:a:mysql:mysql:3.20.32a::::::: cpe:2.3:a:mysql:mysql:3.21::::::: cpe:2.3:a:mysql:mysql:3.22::::::: cpe:2.3:a:mysql:mysql:3.22.26::::::: cpe:2.3:a:mysql:mysql:3.22.27::::::: cpe:2.3:a:mysql:mysql:3.22.28::::::: cpe:2.3:a:mysql:mysql:3.22.29::::::: cpe:2.3:a:mysql:mysql:3.22.30::::::: *cpe:2	OR cpe:2.3:o:debian:debian_linux:5.0:::::::
Changed	Reference Type	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25 No Types Assigned	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25 Issue Tracking, Third Party Advisory
Changed	Reference Type	http://bugs.mysql.com/bug.php?id=32167 Patch	http://bugs.mysql.com/bug.php?id=32167 Issue Tracking, Patch, Vendor Advisory
Changed	Reference Type	http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html No Types Assigned	http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html Third Party Advisory
Changed	Reference Type	http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10591 No Types Assigned	http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10591 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/32578 No Types Assigned	http://secunia.com/advisories/32578 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/32759 No Types Assigned	http://secunia.com/advisories/32759 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/32769 No Types Assigned	http://secunia.com/advisories/32769 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/38517 No Types Assigned	http://secunia.com/advisories/38517 Not Applicable
Changed	Reference Type	http://ubuntu.com/usn/usn-897-1 No Types Assigned	http://ubuntu.com/usn/usn-897-1 Third Party Advisory
Changed	Reference Type	http://www.debian.org/security/2008/dsa-1662 No Types Assigned	http://www.debian.org/security/2008/dsa-1662 Third Party Advisory
Changed	Reference Type	http://www.mandriva.com/security/advisories?name=MDVSA-2009:094 No Types Assigned	http://www.mandriva.com/security/advisories?name=MDVSA-2009:094 Broken Link
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2008/09/09/20 No Types Assigned	http://www.openwall.com/lists/oss-security/2008/09/09/20 Mailing List, Third Party Advisory
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2008/09/16/3 No Types Assigned	http://www.openwall.com/lists/oss-security/2008/09/16/3 Mailing List, Third Party Advisory
Changed	Reference Type	http://www.redhat.com/support/errata/RHSA-2009-1067.html No Types Assigned	http://www.redhat.com/support/errata/RHSA-2009-1067.html Third Party Advisory
Changed	Reference Type	http://www.redhat.com/support/errata/RHSA-2010-0110.html No Types Assigned	http://www.redhat.com/support/errata/RHSA-2010-0110.html Third Party Advisory
Changed	Reference Type	http://www.ubuntu.com/usn/USN-671-1 No Types Assigned	http://www.ubuntu.com/usn/USN-671-1 Third Party Advisory
Changed	Reference Type	http://xforce.iss.net/xforce/xfdb/45649 No Types Assigned	http://xforce.iss.net/xforce/xfdb/45649 Broken Link

Quick Info

CVE Dictionary Entry:
CVE-2008-4098
NVD Published Date:
09/18/2008
NVD Last Modified:
01/04/2018

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2008-4098 Detail

Current Description

Analysis Description

Impact

Vendor Statements (disclaimer)

Official Statement from Red Hat (02/17/2010)

References to Advisories, Solutions, and Tools

References to Check Content

Technical Details

Vulnerable software and versions Switch to CPE 2.2

Change History

CVE Modified by MITRE - 1/4/2018 9:29:00 PM

CVE Modified by MITRE - 9/28/2017 9:31:59 PM

CVE Modified by MITRE - 8/7/2017 9:32:25 PM

Modified Analysis - 8/3/2017 2:07:48 PM

Initial CVE Analysis - 9/18/2008 1:47:00 PM

Quick Info