CVE-2004-0381 in MySQL
Summary
by MITRE
mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/12/2025
The vulnerability identified as CVE-2004-0381 resides within the MySQL database management system's bug reporting utility known as mysqlbug. This flaw represents a classic symlink attack vector that exploits improper handling of temporary files during the bug reporting process. The vulnerability specifically affects local users who can manipulate the file system to execute malicious actions through the mysqlbug utility's temporary file creation mechanism.
The technical implementation of this vulnerability stems from the mysqlbug utility's failure to properly validate or secure temporary file paths when creating the failed-mysql-bugreport file. When the utility encounters a problem during bug reporting, it attempts to create a temporary file to store error information. However, the implementation does not adequately check for or prevent symbolic link manipulation, allowing attackers to create malicious symlinks that point to critical system files or directories. This creates a race condition where the attacker can control what file gets overwritten when the utility creates its temporary file.
From an operational impact perspective, this vulnerability enables local privilege escalation and arbitrary file modification attacks. An attacker with local access to a system running MySQL can leverage this flaw to overwrite critical system files, configuration files, or even executable binaries with malicious content. The attack requires local system access but can potentially lead to complete system compromise depending on the privileges of the MySQL service account and the target files being overwritten. This vulnerability aligns with CWE-377: Insecure Temporary File and CWE-378: Creation of Temporary File With Insecure Permissions, both of which address improper handling of temporary file creation and security implications.
The attack surface for this vulnerability is primarily limited to local users who have access to the system where MySQL is installed, but it can be particularly dangerous in multi-user environments where attackers might have access to shared resources or can manipulate the system to gain the necessary privileges. The vulnerability also has implications for security monitoring, as the malicious file overwrites might not be immediately obvious and could be used to maintain persistence or hide other malicious activities.
Mitigation strategies for this vulnerability include upgrading to a patched version of MySQL where the temporary file handling has been corrected to properly validate file paths and prevent symbolic link manipulation. System administrators should ensure that MySQL installations are regularly updated with security patches and that proper file system permissions are enforced to minimize the impact of such vulnerabilities. Additionally, implementing proper access controls and monitoring for unauthorized file system modifications can help detect potential exploitation attempts. This vulnerability demonstrates the importance of secure temporary file handling practices and aligns with ATT&CK technique T1059.007 for execution through command and scripting interpreter, as well as T1566 for social engineering through manipulation of files and systems.