Description
Race condition in the post-installation script (mysql-server-5.5.postinst) for MySQL Server 5.5 for Debian GNU/Linux and Ubuntu Linux creates a configuration file with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as credentials.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | mysql-5.5 | 5.5.33+dfsg-0+wheezy1 | DSA-2818-1 |
| Debian 6.0 | mysql-5.1 | 5.1.73-1+deb6u1 | DLA-75-1 |
Advisories 2
- DLA-75-1 mysql-5.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2818-1 mysql-5.5 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 54300 third-party-advisory
- DSA-2818 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=711600
- [oss-security] 20130608 Re: CVE request: Debian's package "mysql-server" leaks credential information mailing-list
- 60424 vdb-entry
- USN-1909-1 vendor-advisory