Oracle MySQL 5.5.28 Installation wlbsctrl.dll untrusted search path ⚔ [Disputed]

Summaryinfo

A vulnerability was found in Oracle MySQL 5.5.28. It has been rated as problematic. The impacted element is an unknown function in the library wlbsctrl.dll of the component Installation. Performing a manipulation results in untrusted search path. This vulnerability is known as CVE-2012-5383. Furthermore, an exploit is available. It is still unclear if this vulnerability genuinely exists.

Detailsinfo

A vulnerability classified as critical has been found in Oracle MySQL 5.5.28 (Database Software). This affects an unknown function in the library wlbsctrl.dll of the component Installation. The manipulation with an unknown input leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

** DISPUTED ** Untrusted search path vulnerability in the installation functionality in Oracle MySQL 5.5.28, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the "C:\MySQL\MySQL Server 5.5\bin" directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the MySQL installation.

The weakness was published 10/11/2012 (Website). The advisory is shared at htbridge.com. This vulnerability is uniquely identified as CVE-2012-5383 since 10/11/2012. The exploitability is told to be difficult. An attack has to be approached locally. No form of authentication is needed for exploitation. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1574 for this issue.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k. The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (28130) and OSVDB (86175†). Similar entries are available at VDB-62684, VDB-62683, VDB-62682 and VDB-62681. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Database Software

Vendor

• Oracle

Name

• MySQL

Version

• 5.5.28

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion