PUBLISHED DATE: June 27, 2001CVE-2001-0407:
Directory Traversal Vulnerability

Description

Directory traversal vulnerability in MySQL before 3.23.36 allows local users to modify arbitrary files and gain privileges by creating a database whose name starts with .. (dot dot).

Products

• Oracle MySQL
• Oracle MySQL -
• Oracle MySQL 1.5.1
• Oracle MySQL 3.20.32a
• Oracle MySQL 3.20
• Oracle MySQL 3.21
• Oracle MySQL 3.22.26
• Oracle MySQL 3.22.27
• Oracle MySQL 3.22.28
• Oracle MySQL 3.22.29
• Oracle MySQL 3.22.30
• Oracle MySQL 3.22.32
• Oracle MySQL 3.22
• Oracle MySQL 3.23.0 Alpha
• Oracle MySQL 3.23.10
• Oracle MySQL 3.23.11
• Oracle MySQL 3.23.12
• Oracle MySQL 3.23.13
• Oracle MySQL 3.23.14
• Oracle MySQL 3.23.15
• Oracle MySQL 3.23.16
• Oracle MySQL 3.23.17
• Oracle MySQL 3.23.18
• Oracle MySQL 3.23.19
• Oracle MySQL 3.23.1
• Oracle MySQL 3.23.20 Beta
• Oracle MySQL 3.23.21
• Oracle MySQL 3.23.22
• Oracle MySQL 3.23.23
• Oracle MySQL 3.23.24
• Oracle MySQL 3.23.25
• Oracle MySQL 3.23.26
• Oracle MySQL 3.23.27
• Oracle MySQL 3.23.28
• Oracle MySQL 3.23.28 Gamma
• Oracle MySQL 3.23.29
• Oracle MySQL 3.23.2
• Oracle MySQL 3.23.30
• Oracle MySQL 3.23.31
• Oracle MySQL 3.23.32
• Oracle MySQL 3.23.33
• Oracle MySQL 3.23.34
• Oracle MySQL 3.23.35
• Oracle MySQL 3.23.36
• Oracle MySQL 3.23.3
• Oracle MySQL 3.23.4
• Oracle MySQL 3.23.5
• Oracle MySQL 3.23.6
• Oracle MySQL 3.23.7
• Oracle MySQL 3.23.8
• Oracle MySQL 3.23.9
• Oracle MySQL 3.23

Questions to Ask Vendors

1. Can you confirm whether your systems are affected by CVE-2001-0407, and if so, what steps are you currently taking to mitigate this vulnerability?
2. What is your estimated timeline for fully resolving CVE-2001-0407 in your products or services, and how will you communicate updates on this issue to us as your customer?

Recommended Actions

• Check out the advisory links provided below.

References

• https://nvd.nist.gov/vuln/detail/CVE-2001-0407