GLSA 200405-20: Insecure Temporary File Creation In MySQL

Title:Insecure Temporary File Creation In MySQL
Bugs: #46242


Two MySQL utilities create temporary files with hardcoded paths, allowing an attacker to use a symlink to trick MySQL into overwriting important data.


MySQL is a popular open-source multi-threaded, multi-user SQL database server.

Affected packages

Package Vulnerable Unaffected Architecture(s)
dev-db/mysql < 4.0.18-r2 >= 4.0.18-r2 All supported architectures


The MySQL bug reporting utility (mysqlbug) creates a temporary file to log bug reports to. A malicious local user with write access to the /tmp directory could create a symbolic link of the name mysqlbug-N pointing to a protected file, such as /etc/passwd, such that when mysqlbug creates the Nth log file, it would end up overwriting the target file. A similar vulnerability exists with the mysql_multi utility, which creates a temporary file called mysql_multi.log.


Since mysql_multi runs as root, a local attacker could use this to destroy any other users' data or corrupt and destroy system files.


One could modify both scripts to log to a directory that users do not have write permission to, such as /var/log/mysql/.


All users should upgrade to the latest stable version of MySQL.

    # emerge sync

    # emerge -pv ">=dev-db/mysql-4.0.18-r2"
    # emerge ">=dev-db/mysql-4.0.18-r2"



This GLSA and any updates to it are available for viewing at the Gentoo Security Website:


Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to or alternatively, you may file a bug at


Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

Thank you!