Re: A mysql flaw.

[Josh Bressers <bressers () redhat com>]

Please use CVE-2010-1621 for this.

Thanks.

-- 
    JB


----- "Oden Eriksson" <oeriksson () mandriva com> wrote:

> Hello.
>
> With the mysql-5.1.46 release they fixed a security issue mentioned
> here:
>
> http://bugs.mysql.com/bug.php?id=51770
>
> [...]
>
> 3375 Davi Arnaut    2010-03-09
>       Bug#51770: UNINSTALL PLUGIN requires no privileges
>
>       The problem was that UNINSTALL PLUGIN wasn't performing
> privilege
>       checks before removing a plugin. Any user (including users
> without 
>       any kind of privileges) could uninstall any plugin.
>
>       The solution is to verify if the user has the DELETE privilege
> for
>       the mysql.plugin table before uninstalling a plugin.
>
> [...]
>
> A CVE should probably be assigned for this.
>
>
> -- 
> Regards // Oden Eriksson
> Security team manager - Mandriva
> C∞O @ NUX™ AB