[VU:567764] MySQL for Windows is vulnerable to privilege escalation due to OPENSSLDIR location
Overview
MySQL for Windows contains a privilege escalation vulnerability due to the use of an OPENSSLDIR
variable that specifies a location where an unprivileged Windows user can create files.
Description
CVE-2021-2307
MySQL includes an OpenSSL component that specifies an OPENSSLDIR
variable as a subdirectory of /build_area/
. On the Windows platform, this path is interpreted as C:\build_area
. MySQL contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf
file to achieve arbitrary code execution with SYSTEM privileges.
Impact
By placing a specially-crafted openssl.cnf
in a C:\build_area
subdirectory, an unprivileged user may be able to execute arbitrary code with SYSTEM privileges on a Windows system with the vulnerable MySQL software installed.
Solution
Apply an update
This vulnerability is addressed in the MySQL Windows installer version 8.0.24 and 5.7.34.
Create a C:\build_area directory
In cases where an update cannot be installed, this vulnerability can be mitigated by creating a C:\build_area
directory and restricting ACLs to prevent unprivileged users from being able to write to this location.
Acknowledgements
This vulnerability was reported by Will Dormann of the CERT/CC.
This document was written by Will Dormann.
- ID
- VU:567764
- Severity
- medium
- Severity from
- CVE-2021-2307
- URL
- https://kb.cert.org/vuls/id/567764
- Published
-
2021-04-20T22:14:05
(3 years ago) - Modified
-
2021-04-22T12:08:07
(3 years ago) - Rights
- Copyright 2021, CERT Coordination Center (CERT/CC)
- Other Advisories
Source | # ID | Name | URL |
---|---|---|---|
https://www.oracle.com/security-alerts/cpuapr2021.html |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |