Multiple vulnerabilities exist in MySQL and MariaDB that could allow an attacker to remotely execute code, escalate privileges, and create denial of service conditions. CVE-2012-5611 is the only remotely attackable vulnerability; the latest stable version of MariaDB is not vulnerable.
Monty Program Ab, Oracle
MySQL 5.5.19, 5.1.53
MariaDB 5.5.2x < 5.5.28a, 5.3.x < 5.3.11, 5.2.x < 5.2.13, 5.1.x < 5.1.66
MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66
Remote Code Execution
Exploitation of this vulnerability is possible from external vectors. Successful exploitation may grant attackers arbitrary remote code execution within the security context of MySQL.
BeyondTrust Prevention and Detection:
Do not give the FILE permission to non-admin users. Utilize the –secure-file-priv option and restrict all FILE operations to a specific location. Additionally, compiling MySQL and MariaDB using a hardened toolchain (employing memory protections such as –z, relro) may benefit efforts to mitigate these vulnerabilities, although this has not been confirmed.
- Full Disclosure (CVE-2012-5611)
- Full Disclosure (CVE-2012-5612)
- Full Disclosure (CVE-2012-5614)
- Full Disclosure (CVE-2012-5615)
- Exploit-DB (CVE-2012-5611)
- Exploit-DB (CVE-2012-5612)
- Exploit-DB (CVE-2012-5614)
- Exploit-DB (1) (CVE-2012-5615)
- Exploit-DB (2) (CVE-2012-5615)