UNINSTALL PLUGIN, looking in the mysql_uninstall_plugin() function shows that there is no code at all for checking required privileges. This means that ANY user, even a user with no privileges, can uninstall ANY plugin. (At least plugins that are loaded dynamically.) http://bugs.mysql.com/bug.php?id=51770
Upstream commit: http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.1-bugteam/revision/3351.1.45 Fixed upstream in 5.1.46: http://dev.mysql.com/doc/refman/5.1/en/news-5-1-46.html This issue does not affect mysql packages version in Red Hat Enterprise Linux 3, 4 and 5, as they don't support plugins.
mysql-5.1.46-1.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/mysql-5.1.46-1.fc11
mysql-5.1.46-1.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/mysql-5.1.46-1.fc12
mysql-5.1.46-1.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/mysql-5.1.46-1.fc13
mysql-5.1.46-1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
mysql-5.1.46-1.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.
mysql-5.1.46-1.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
Statement: Not vulnerable. These issues did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 3, 4, or 5.