You are viewing this page in an unauthorized frame window.

This is a potential security issue, you are being redirected to https://nvd.nist.gov

You have JavaScript disabled. This site requires JavaScript to be enabled for complete site functionality.

U.S. flag An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

  1. Vulnerabilities

CVE-2007-2691 Detail

Deferred

This CVE record is not being prioritized for NVD enrichment efforts due to resource or other concerns.

Description

MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.
CVSS 3.x Severity and Vector Strings:

NIST CVSS score
NIST: NVD
Base Score: N/A
NVD assessment not yet provided.
CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology
NIST: NVD
Base Score: 4.9 MEDIUM
Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:P)

Evaluator Solution

The vendor has released a product update to address this issue: Upgrade to MySQL version 5.1.18: http://dev.mysql.com/downloads/

Vendor Statements (disclaimer)

Official Statement from Red Hat (05/29/2007)

Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2007-2691 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
http://bugs.mysql.com/bug.php?id=27515 CVE, MITRE Vendor Advisory
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html CVE, MITRE Patch Vendor Advisory
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html CVE, MITRE Mailing List Third Party Advisory
http://lists.mysql.com/announce/470 CVE, MITRE Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html CVE, MITRE Third Party Advisory
http://osvdb.org/34766 CVE, MITRE Broken Link
http://secunia.com/advisories/25301 CVE, MITRE Third Party Advisory
http://secunia.com/advisories/25946 CVE, MITRE Third Party Advisory
http://secunia.com/advisories/26073 CVE, MITRE Third Party Advisory
http://secunia.com/advisories/26430 CVE, MITRE Third Party Advisory
http://secunia.com/advisories/27155 CVE, MITRE Third Party Advisory
http://secunia.com/advisories/27823 CVE, MITRE Third Party Advisory
http://secunia.com/advisories/28838 CVE, MITRE Third Party Advisory
http://secunia.com/advisories/30351 CVE, MITRE Third Party Advisory
http://secunia.com/advisories/31226 CVE, MITRE Third Party Advisory
http://secunia.com/advisories/32222 CVE, MITRE Third Party Advisory
http://support.apple.com/kb/HT3216 CVE, MITRE Third Party Advisory
http://www.debian.org/security/2007/dsa-1413 CVE, MITRE Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:139 CVE, MITRE Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2007-0894.html CVE, MITRE Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-0364.html CVE, MITRE Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-0768.html CVE, MITRE Third Party Advisory
http://www.securityfocus.com/archive/1/473874/100/0/threaded CVE, MITRE Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/24016 CVE, MITRE Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/31681 CVE, MITRE Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1018069 CVE, MITRE Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2007/1804 CVE, MITRE Third Party Advisory
http://www.vupen.com/english/advisories/2008/2780 CVE, MITRE Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/34347 CVE, MITRE Third Party Advisory VDB Entry
https://issues.rpath.com/browse/RPL-1536 CVE, MITRE Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9559 CVE, MITRE Third Party Advisory
https://usn.ubuntu.com/528-1/ CVE, MITRE Third Party Advisory

Weakness Enumeration

CWE-ID CWE Name Source
NVD-CWE-Other Other cwe source acceptance level NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

8 change records found show changes

CVE Modified by CVE 11/20/2024 7:31:25 PM

Action Type Old Value New Value
Added Reference 
http://bugs.mysql.com/bug.php?id=27515
Added Reference 
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html
Added Reference 
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
Added Reference 
http://lists.mysql.com/announce/470
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
Added Reference 
http://osvdb.org/34766
Added Reference 
http://secunia.com/advisories/25301
Added Reference 
http://secunia.com/advisories/25946
Added Reference 
http://secunia.com/advisories/26073
Added Reference 
http://secunia.com/advisories/26430
Added Reference 
http://secunia.com/advisories/27155
Added Reference 
http://secunia.com/advisories/27823
Added Reference 
http://secunia.com/advisories/28838
Added Reference 
http://secunia.com/advisories/30351
Added Reference 
http://secunia.com/advisories/31226
Added Reference 
http://secunia.com/advisories/32222
Added Reference 
http://support.apple.com/kb/HT3216
Added Reference 
http://www.debian.org/security/2007/dsa-1413
Added Reference 
http://www.mandriva.com/security/advisories?name=MDKSA-2007:139
Added Reference 
http://www.redhat.com/support/errata/RHSA-2007-0894.html
Added Reference 
http://www.redhat.com/support/errata/RHSA-2008-0364.html
Added Reference 
http://www.redhat.com/support/errata/RHSA-2008-0768.html
Added Reference 
http://www.securityfocus.com/archive/1/473874/100/0/threaded
Added Reference 
http://www.securityfocus.com/bid/24016
Added Reference 
http://www.securityfocus.com/bid/31681
Added Reference 
http://www.securitytracker.com/id?1018069
Added Reference 
http://www.vupen.com/english/advisories/2007/1804
Added Reference 
http://www.vupen.com/english/advisories/2008/2780
Added Reference 
https://exchange.xforce.ibmcloud.com/vulnerabilities/34347
Added Reference 
https://issues.rpath.com/browse/RPL-1536
Added Reference 
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9559
Added Reference 
https://usn.ubuntu.com/528-1/

CVE Modified by MITRE 5/13/2024 9:45:22 PM

Action Type Old Value New Value

Modified Analysis by NIST 10/19/2018 3:00:08 PM

Action Type Old Value New Value
Changed CPE Configuration Record truncated, showing 2048 of 3965 characters.
View Entire Change Record 
OR
 *cpe:2.3:a:mysql:mysql:4.1:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.0:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.0:alpha:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.0.0:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.1:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.2:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.2:alpha:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.10:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.10a:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.11:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.12:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.12a:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.13:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.13a:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.14:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.14a:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.15:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.15a:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.16:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.17:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.18:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.19:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.20:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:4.1.21:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:* versions up to (including) 4.1.22
 *cpe:2.3:a:mysql:mysql:5.0:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.0:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.0:alpha:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.0.0:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.1a:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.3:beta:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.3a:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.4a:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.5:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.5.0.21:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.6:*:*:*:*:*:*:*
 *cpe:2.3:a:mysql:mysql:5.0.7:*:*:*:*:*:*:*
 
OR
 *cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:* versions up to (including) 4.1.22
 *cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:* versions from (including) 5.0 up to (excluding) 5.0.42
 *cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:* versions from (including) 5.1 up to (excluding) 5.1.18
Added CPE Configuration 
OR
 *cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
Added CPE Configuration 
OR
 *cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
 *cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
Changed Reference Type 
http://bugs.mysql.com/bug.php?id=27515 No Types Assigned


 
http://bugs.mysql.com/bug.php?id=27515 Vendor Advisory
Changed Reference Type 
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html Patch


 
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html Patch, Vendor Advisory
Changed Reference Type 
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html No Types Assigned


 
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html Mailing List, Third Party Advisory
Changed Reference Type 
http://lists.mysql.com/announce/470 No Types Assigned


 
http://lists.mysql.com/announce/470 Vendor Advisory
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html Third Party Advisory
Changed Reference Type 
http://osvdb.org/34766 No Types Assigned


 
http://osvdb.org/34766 Broken Link
Changed Reference Type 
http://secunia.com/advisories/25301 No Types Assigned


 
http://secunia.com/advisories/25301 Third Party Advisory
Changed Reference Type 
http://secunia.com/advisories/25946 No Types Assigned


 
http://secunia.com/advisories/25946 Third Party Advisory
Changed Reference Type 
http://secunia.com/advisories/26073 No Types Assigned


 
http://secunia.com/advisories/26073 Third Party Advisory
Changed Reference Type 
http://secunia.com/advisories/26430 No Types Assigned


 
http://secunia.com/advisories/26430 Third Party Advisory
Changed Reference Type 
http://secunia.com/advisories/27155 No Types Assigned


 
http://secunia.com/advisories/27155 Third Party Advisory
Changed Reference Type 
http://secunia.com/advisories/27823 No Types Assigned


 
http://secunia.com/advisories/27823 Third Party Advisory
Changed Reference Type 
http://secunia.com/advisories/28838 No Types Assigned


 
http://secunia.com/advisories/28838 Third Party Advisory
Changed Reference Type 
http://secunia.com/advisories/30351 No Types Assigned


 
http://secunia.com/advisories/30351 Third Party Advisory
Changed Reference Type 
http://secunia.com/advisories/31226 No Types Assigned


 
http://secunia.com/advisories/31226 Third Party Advisory
Changed Reference Type 
http://secunia.com/advisories/32222 No Types Assigned


 
http://secunia.com/advisories/32222 Third Party Advisory
Changed Reference Type 
http://support.apple.com/kb/HT3216 No Types Assigned


 
http://support.apple.com/kb/HT3216 Third Party Advisory
Changed Reference Type 
http://www.debian.org/security/2007/dsa-1413 No Types Assigned


 
http://www.debian.org/security/2007/dsa-1413 Third Party Advisory
Changed Reference Type 
http://www.mandriva.com/security/advisories?name=MDKSA-2007:139 No Types Assigned


 
http://www.mandriva.com/security/advisories?name=MDKSA-2007:139 Third Party Advisory
Changed Reference Type 
http://www.redhat.com/support/errata/RHSA-2007-0894.html No Types Assigned


 
http://www.redhat.com/support/errata/RHSA-2007-0894.html Third Party Advisory
Changed Reference Type 
http://www.redhat.com/support/errata/RHSA-2008-0364.html No Types Assigned


 
http://www.redhat.com/support/errata/RHSA-2008-0364.html Third Party Advisory
Changed Reference Type 
http://www.redhat.com/support/errata/RHSA-2008-0768.html No Types Assigned


 
http://www.redhat.com/support/errata/RHSA-2008-0768.html Third Party Advisory
Changed Reference Type 
http://www.securityfocus.com/archive/1/473874/100/0/threaded No Types Assigned


 
http://www.securityfocus.com/archive/1/473874/100/0/threaded Third Party Advisory, VDB Entry
Changed Reference Type 
http://www.securityfocus.com/bid/24016 No Types Assigned


 
http://www.securityfocus.com/bid/24016 Third Party Advisory, VDB Entry
Changed Reference Type 
http://www.securityfocus.com/bid/31681 No Types Assigned


 
http://www.securityfocus.com/bid/31681 Third Party Advisory, VDB Entry
Changed Reference Type 
http://www.securitytracker.com/id?1018069 No Types Assigned


 
http://www.securitytracker.com/id?1018069 Third Party Advisory, VDB Entry
Changed Reference Type 
http://www.vupen.com/english/advisories/2007/1804 No Types Assigned


 
http://www.vupen.com/english/advisories/2007/1804 Third Party Advisory
Changed Reference Type 
http://www.vupen.com/english/advisories/2008/2780 No Types Assigned


 
http://www.vupen.com/english/advisories/2008/2780 Third Party Advisory
Changed Reference Type 
https://exchange.xforce.ibmcloud.com/vulnerabilities/34347 No Types Assigned


 
https://exchange.xforce.ibmcloud.com/vulnerabilities/34347 Third Party Advisory, VDB Entry
Changed Reference Type 
https://issues.rpath.com/browse/RPL-1536 No Types Assigned


 
https://issues.rpath.com/browse/RPL-1536 Broken Link
Changed Reference Type 
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9559 No Types Assigned


 
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9559 Third Party Advisory
Changed Reference Type 
https://usn.ubuntu.com/528-1/ No Types Assigned


 
https://usn.ubuntu.com/528-1/ Third Party Advisory

CVE Modified by MITRE 10/16/2018 12:45:09 PM

Action Type Old Value New Value
Added Reference 
http://www.securityfocus.com/archive/1/473874/100/0/threaded [No Types Assigned]
Removed Reference 
http://www.securityfocus.com/archive/1/archive/1/473874/100/0/threaded [No Types Assigned]

CVE Modified by MITRE 10/03/2018 5:47:07 PM

Action Type Old Value New Value
Added Reference 
https://usn.ubuntu.com/528-1/ [No Types Assigned]
Removed Reference 
http://www.ubuntulinux.org/support/documentation/usn/usn-528-1 [No Types Assigned]

CVE Modified by MITRE 10/10/2017 9:32:20 PM

Action Type Old Value New Value
Added Reference 
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9559 [No Types Assigned]
Removed Reference 
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9559 [No Types Assigned]

CVE Modified by MITRE 7/28/2017 9:31:39 PM

Action Type Old Value New Value
Added Reference 
https://exchange.xforce.ibmcloud.com/vulnerabilities/34347 [No Types Assigned]
Removed Reference 
http://xforce.iss.net/xforce/xfdb/34347 [No Types Assigned]

Initial CVE Analysis 5/17/2007 9:56:00 AM

Action Type Old Value New Value

Quick Info

CVE Dictionary Entry:
CVE-2007-2691
NVD Published Date:
05/15/2007
NVD Last Modified:
04/08/2025
Source:
MITRE

AltStyle によって変換されたページ (->オリジナル) /