{"vuid":"VU#203897","idnumber":"203897","name":"MySQL allows default user to be changed to root via custom \"my.cnf\" file","keywords":["MySQL","default user","root","my.cnf"],"overview":"MySQL reads configuration options from world-writeable files. This can lead to a remote user gaining elevated privileges.","clean_desc":"A message posted to the bugtraq mailing list details a vulnerability affecting versions of MySQL prior to 3.23.56. MySQL would permit users with 'FILE' permissions to create and edit world-writeable configuration files. Upon rebooting the server, MySQL would read these files and be configured to give a remote user elevated privileges.","impact":"Exploitation of this vulnerability can lead to a remote user gaining elevated privileges and subsequently gaining control of the MySQL database.","resolution":"Version 3.23.56 of MySQL resolves this issue. Likewise, you may apply the patch or upgrade supplied by your vendor for this issue.","workarounds":"","sysaffected":"","thanks":"Thanks to Gufino for reporting this vulnerability.","author":"This document was written by Jason A Rafail.","public":["h","t","t","p",":","/","/","l","i","s","t","s",".","m","y","s","q","l",".","c","o","m","/","c","g","i","-","e","z","/","e","z","m","l","m","-","c","g","i","?","2",":","m","s","s",":","1","5","9",":","2","0","0","3","0","3",":","a","n","l","m","c","i","l","g","g","a","o","m","m","d","k","b","c","b","o","e"],"cveids":["CVE-2003-0150"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2003-03-10T16:42:14Z","publicdate":"2003-03-08T00:00:00Z","datefirstpublished":"2003-03-18T20:49:42Z","dateupdated":"2003-03-20T16:12:33Z","revision":8,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"14","cam_population":"15","cam_impact":"17","cam_easeofexploitation":"17","cam_attackeraccessrequired":"4","cam_scorecurrent":"9.428625","cam_scorecurrentwidelyknown":"11.05425","cam_scorecurrentwidelyknownexploited":"17.55675","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":9.428625,"vulnote":null}