The version of MySQL installed on the remote host is older than 3.23.56.  As such, it reportedly creates world-writeable files.  By restarting the MySQL daemon under root ID, a local attacker could gain root privileges.

リモートホストにインストールされている MySQL のバージョンが、3.23.56より前のものです。このため、誰でも書き込めるファイルを作成することが報告されています。root ID 下で MySQL デーモンを再起動することにより、ローカルの攻撃者が root 権限を取得できる可能性があります。

MySQL 的远程版本低于 3.23.56。这些版本受到一个问题的影响，可能允许 mysqld 服务以升级后的权限启动。攻击者可能通过创建“DATADIR/my.cnf”来利用该漏洞，其在“[mysqld]”选项部分下包含行“user=root”。当 mysqld 服务执行时，将以根用户身份运行，而非默认用户。

MySQL のリモートバージョンは、3.23.56 より前です。このようなバージョンは、mysqld サービスを昇格した権限で開始できる問題の影響を受けます。攻撃者は、「[mysqld]」オプションセクションに行「user=root」が含まれている「DATADIR/my.cnf」を作成することで、この脆弱性を悪用できます。mysqld サービスが実行されると、デフォルトユーザーの代わりに root ユーザーとして実行されます。

遠端主機上安裝的 MySQL 版本比 3.23.56 舊。因此，據報其會建立任何人皆可寫入的檔案。本機攻擊者在 root ID 下重新啟動 MySQL 程序，便可取得 root 權限。

Updated packages are available that fix both a double-free security vulnerability and a remote root exploit security vulnerability found in the MySQL server.

[Updated 11 Aug 2003] Updated mysqlclient9 packages are now included.
These were previously missing from this erratum.

MySQL is a multi-user, multi-threaded SQL database server.

A double-free vulnerability in mysqld, for MySQL before version 3.23.55, allows attackers with MySQL access to cause a denial of service (crash) by creating a carefully crafted client application.

A remote root exploit vulnerability in mysqld, for MySQL before version 3.23.56, allows MySQL users to gain root privileges by overwriting configuration files.

Previous versions of the MySQL packages do not contain the thread safe client library (libmysqlclient_r).

All users of MySQL are advised to upgrade to these errata packages containing MySQL 3.23.56.

CAN-2003-0073: The mysql package contains a bug whereby dynamically allocated memory is freed more than once, which could be deliberately triggered by an attacker to cause a crash, resulting in a denial of service condition. In order to exploit this vulnerability, a valid username and password combination for access to the MySQL server is required.

CAN-2003-0150: The mysql package contains a bug whereby a malicious user, granted certain permissions within mysql, could create a configuration file which would cause the mysql server to run as root, or any other user, rather than the mysql user.

The remote version of MySQL is older than 3.23.56.  Such versions are affected by an issue that may allow the mysqld service to start with elevated privileges.  An attacker can exploit this vulnerability by creating a 'DATADIR/my.cnf' that includes the line 'user=root' under the '[mysqld]' option section.  When the mysqld service is executed, it will run as the root user instead of the default user.

In MySQL 3.23.55 and earlier, MySQL would create world-writeable files and allow mysql users to gain root privileges by using the 'SELECT * INTO OUTFILE' operator to overwrite a configuration file, which could cause mysql to run as root upon restarting the daemon.

This has been fixed upstream in version 3.23.56, which is provided for Mandrake Linux 9.0 and Corporate Server 2.1 users. The other updated packages have been patched to correct this issue.

远程主机上安装的 MySQL 版本低于 3.23.56。因此据报告，其创建全局可写的文件。通过重新启动根 ID 下的 MySQL 后台程序，本地攻击者可获得跟权限。

The remote host is running a version of MySQL which is older than version 3.23.56. A vulnerability exists that may allow the mysqld service to start with elevated privileges. An attacker can exploit this vulnerability by creating a DATADIR/my.cnf that includes the line 'user'. 

The remote host is running a version of MySQL which is older than version 3.23.55. If you have not patched this version, then any attacker with a valid username may crash this service remotely by exploiting a double free bug.
 Further exploitation to gain a shell on the host may also be possible. 

The remote host is running a version of MySQL which is older than version 3.23.56. A vulnerability exists that may allow the mysqld service to start with elevated privileges. An attacker can exploit this vulnerability by creating a DATADIR/my.cnf that includes the line 'user'.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
17820	MySQL < 3.23.56 Writable Configuration Files	Nessus	Databases	2012/1/18	2018/11/15	high
17820	MySQL < 3.23.56における書き込み可能な構成ファイル	Nessus	Databases	2012/1/18	2018/11/15	high
11378	MySQL datadir/my.cnf 修改权限升级	Nessus	Databases	2003/3/14	2022/4/11	high
11378	MySQL datadir/my.cnf 変更の権限昇格	Nessus	Databases	2003/3/14	2022/4/11	high
17820	MySQL < 3.23.56 可寫入的設定檔	Nessus	Databases	2012/1/18	2018/11/15	high
12378	RHEL 2.1 : mysql (RHSA-2003:094)	Nessus	Red Hat Local Security Checks	2004/7/6	2021/1/14	high
15140	Debian DSA-303-1 : mysql - privilege escalation	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	high
11378	MySQL datadir/my.cnf Modification Privilege Escalation	Nessus	Databases	2003/3/14	2022/4/11	high
14041	Mandrake Linux Security Advisory : MySQL (MDKSA-2003:057)	Nessus	Mandriva Local Security Checks	2004/7/31	2021/1/6	high
17820	MySQL < 3.23.56 可写配置文件	Nessus	Databases	2012/1/18	2018/11/15	high
1900	Oracle MySQL < 3.23.56 Local Privilege Escalation	Nessus Network Monitor	Database	2004/8/20	2019/3/6	high
1908	Oracle MySQL < 3.23.55 Double Free() Overflow	Nessus Network Monitor	Database	2004/8/20	2019/3/6	high
801161	MySQL < 3.23.55 Double Free() Overflow	Log Correlation Engine	Database			high
801167	MySQL < 3.23.56 Local Privilege Escalation	Log Correlation Engine	Database			high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high