A mysql flaw.

[Oden Eriksson <oeriksson () mandriva com>]

Hello.

With the mysql-5.1.46 release they fixed a security issue mentioned here:

http://bugs.mysql.com/bug.php?id=51770

[...]

3375 Davi Arnaut    2010-03-09
      Bug#51770: UNINSTALL PLUGIN requires no privileges

      The problem was that UNINSTALL PLUGIN wasn't performing privilege
      checks before removing a plugin. Any user (including users without 
      any kind of privileges) could uninstall any plugin.

      The solution is to verify if the user has the DELETE privilege for
      the mysql.plugin table before uninstalling a plugin.

[...]

A CVE should probably be assigned for this.


-- 
Regards // Oden Eriksson
Security team manager - Mandriva
C∞O @ NUX™ AB