Description of problem:
Table structure can be seen by an auhenticated user
w/o SELECT privilege on that table.
Use of view overrides column update privileges on underlying table
The Red Hat Security Response Team has rated this issue as having low security
impact. We do not intend to issue an asynchronous security update to correct
this flaw at this time, but will look to include a fix for this issue if we
update MySQL in the future (for example for an Update release or to fix issues
of higher severity).
*** Bug 254109 has been marked as a duplicate of this bug. ***
*** Bug 254107 has been marked as a duplicate of this bug. ***
Upstream bug reports:
CVE-2007-3781 - http://bugs.mysql.com/bug.php?id=25578
CVE-2007-3782 - http://bugs.mysql.com/bug.php?id=27878
CVE-2007-3781 affects MySQL versions as shipped in Red Hat Enterprise Linux 4
and 5. It only allows authenticated database users to obtain information about
structure of the table (CREATE TABLE SQL statement that can be used to re-create
table, without data inside table) of some other user.
CVE-2007-3782 only affects MySQL version as shipped in Red Hat Enterprise Linux
5. Previous versions of MySQL (prior to 5.0) do not support views.
Reporter changed to firstname.lastname@example.org by request of Jay Turner.
Both CVE-2007-3781 and CVE-2007-3782 were addressed via:
Red Hat Application Stack v1 for Enterprise Linux AS (v.4) (RHSA-2007:0894)
Red Hat Enterprise Linux version 5 (RHSA-2008:0364)