CVE-2008-7247

Publication date 30 November 2009

Last updated 24 July 2024

sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink.

Read the notes from the security team

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
mysql-5.1	10.10 maverick	Fixed 5.1.41-3ubuntu7
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
mysql-dfsg	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Ignored end of life
mysql-dfsg-4.1	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Ignored end of life
mysql-dfsg-5.0	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	6.06 LTS dapper	Not affected
mysql-dfsg-5.1	10.10 maverick	Not in release
	10.04 LTS lucid	Fixed 5.1.41-3ubuntu7
	9.10 karmic	Fixed 5.1.37-1ubuntu5.1
	9.04 jaunty	Ignored end of life
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release

Notes

mdeslaur

This isn’t fixed in 5.1.42, as of 2010-01-20 upstream hasn’t patched 5.1.x per upstream bug, don’t think it’s a security issue code is different in 5.0.x and analysis done here: http://marc.info/?l=oss-security&m=126097698329834&w=2 says 5.0.x is not affected.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
mysql-dfsg-5.1	Vendor: http://cvs.fedoraproject.org/viewvc/devel/mysql/mysql-cve-2008-7247.patch?revision=1.1&view=markup Upstream: http://lists.mysql.com/commits/91835 Upstream: http://lists.mysql.com/commits/59711

CVE-2008-7247

Status

Notes

mdeslaur

Patch details

References

Related Ubuntu Security Notices (USN)

Other references