MySQL Community Server symlink attack vulnerability

Description

The MySQL Community Server installed on the remote host fails to check whether a file to which a symlink points exists when using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options. A local attacker can overwrite system table information by replacing the file to which the symlink points.

Remediation

Upgrade to MySQL Community Server version 5.0.51 or later.

References