CVE-2003-0150 in MySQL
Summary
by MITRE
MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/15/2024
This vulnerability exists in MySQL versions 3.23.55 and earlier where the database system fails to properly validate file permissions when executing the SELECT * INTO OUTFILE statement. The flaw allows authenticated mysql users to write files to arbitrary locations on the filesystem with world-writable permissions, creating a critical privilege escalation vector. When combined with the ability to overwrite system configuration files such as my.cnf, an attacker can manipulate the mysql daemon to execute with root privileges upon restart. This represents a fundamental failure in the database engine's file system access controls and privilege management mechanisms.
The technical exploitation involves leveraging the OUTFILE functionality to write malicious configuration content to the mysql configuration file location, typically /etc/my.cnf or similar system paths. The vulnerability stems from inadequate permission checking during file creation operations, where the system creates files with overly permissive permissions that allow any user to modify them. This design flaw directly maps to CWE-73, which addresses improper limitation of a pathname to a restricted directory, and CWE-276, concerning incorrect permissions for system resources. The vulnerability enables attackers to gain root access to the system through a simple database query execution, bypassing normal authentication and authorization mechanisms.
The operational impact of this vulnerability is severe as it provides a complete compromise path from database user access to system root privileges. An attacker with minimal database permissions can escalate their access level to execute arbitrary code with the highest system privileges, potentially leading to full system control. The attack requires only basic database user credentials and knowledge of the OUTFILE functionality, making it particularly dangerous in environments where database users have broad access rights. This vulnerability directly aligns with ATT&CK technique T1068, which covers 'Exploitation for Privilege Escalation', and T1548.001, covering 'Abuse of Functionality'.
Mitigation strategies include immediate patching to newer MySQL versions that properly implement file permission checks and restrict OUTFILE operations to safe directories only. Administrators should disable the OUTFILE functionality entirely if not required for legitimate operations, implement strict file system permissions for mysql configuration files, and establish proper monitoring for suspicious file creation patterns. The database server should be configured to run with minimal required privileges, and access controls should be strictly enforced to prevent unauthorized file system modifications. Additionally, implementing network segmentation and database auditing can help detect and prevent exploitation attempts, while regular security assessments should verify that no world-writable files exist in critical system directories.