CVE-2008-4097

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-09-18 · updated 2026-06-16
Weakness: CWE-264

Description

MySQL 5.0.51a allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are associated with symlinks within pathnames for subdirectories of the MySQL home data directory, which are followed when tables are created in the future. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-2079.

Affected products

MySQL Server: 5.0.51a

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
http://secunia.com/advisories/32759
http://secunia.com/advisories/32769
http://www.mandriva.com/security/advisories?name=MDVSA-2009:094
http://www.openwall.com/lists/oss-security/2008/09/09/20
http://www.openwall.com/lists/oss-security/2008/09/16/3
http://www.ubuntu.com/usn/USN-671-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/45648
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
http://secunia.com/advisories/32759

Get alerted when CVE-2008-4097 or the next vulnerability affects your stack