Description

MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory.

Remediation

References

CVE-2010-2008

Related Vulnerabilities

WordPress Plugin Church Admin Arbitrary File Upload (4.4.6)

SugarCRM Other Vulnerability (CVE-2006-2460)

Oracle Database Server CVE-2007-0273 Vulnerability (CVE-2007-0273)

Python Integer Overflow or Wraparound Vulnerability (CVE-2008-3144)

Atlassian Jira CVE-2020-36237 Vulnerability (CVE-2020-36237)

Severity

Low

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2010-2008