Re: A mysql flaw.

[Oden Eriksson <oeriksson () mandriva com>]

lördagen den 8 maj 2010 02.56.06 skrev  Josh Bressers:
> Please use CVE-2010-1621 for this.
>
> Thanks.

Thanks Josh.
 
> > Hello.
> >
> > With the mysql-5.1.46 release they fixed a security issue mentioned
> > here:
> >
> > http://bugs.mysql.com/bug.php?id=51770
> >
> > [...]
> >
> > 3375 Davi Arnaut    2010-03-09
> >       Bug#51770: UNINSTALL PLUGIN requires no privileges
> >
> >       The problem was that UNINSTALL PLUGIN wasn't performing
> > privilege
> >       checks before removing a plugin. Any user (including users
> > without
> >       any kind of privileges) could uninstall any plugin.
> >
> >       The solution is to verify if the user has the DELETE privilege
> > for
> >       the mysql.plugin table before uninstalling a plugin.
> >
> > [...]
> >
> > A CVE should probably be assigned for this.

-- 
Regards // Oden Eriksson
Security team manager - Mandriva
C∞O @ NUX™ AB