Skip to content
Fencer Vulns
medium 6.5

CVE-2006-4227 json

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of…

published 2006-08-18 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-4217

cvss
6.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
13.6%
EPSS 13.6% chance of exploitation in 30 days, percentile 96%
public exploits
1
Exploit-DB

Summary

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

Patch / fix

  • mysql RHEL 5 5.0.45-7.el5
  • mysql-test RHEL 5 5.0.45-7.el5
  • mysql-bench RHEL 5 5.0.45-7.el5
  • mysql-server RHEL 5 5.0.45-7.el5
  • mysql RHEL 1 APPLICATION_STACK 5.0.30-1.el4s1.1
  • mysql-test RHEL 1 APPLICATION_STACK 5.0.30-1.el4s1.1
  • mysql-bench RHEL 1 APPLICATION_STACK 5.0.30-1.el4s1.1
  • mysql-server RHEL 1 APPLICATION_STACK 5.0.30-1.el4s1.1

red hat advisories RHSA-2008:0364RHSA-2007:0083

  • mariadb104 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 10.4.30-8.5.46
  • lz4 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.8.0-3.5.2
  • python-mysqlclient SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.3.14-8.9.2
  • mariadb-connector-c SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 3.1.22-2.35.1
  • mariadb104 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 10.4.30-150100.3.5.10
  • python-mysqlclient SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 1.4.6-150100.3.3.7

suse advisories SUSE-RU-2023:4991-1SUSE-RU-2023:3956-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2006-4227 updated

mysql improper suid argument evaluation

  • Red Hat Application Stack v1 for Enterprise Linux AS (v.4) mysql 5.0.30-1.el4s1.1, mysql-test 5.0.30-1.el4s1.1, mysql-bench 5.0.30-1.el4s1.1, mysql-server 5.0.30-1.el4s1.1 Red Hat Application Stack v1 for Enterprise Linux ES (v.4) mysql 5.0.30-1.el4s1.1, mysql-test 5.0.30-1.el4s1.1, mysql-bench 5.0.30-1.el4s1.1, mysql-server 5.0.30-1.el4s1.1
    fixed: vendor fix RHSA-2007:0083
  • Red Hat Enterprise Linux (v. 5 server) mysql 5.0.45-7.el5, mysql-test 5.0.45-7.el5, mysql-bench 5.0.45-7.el5, mysql-server 5.0.45-7.el5 Red Hat Enterprise Linux Desktop (v. 5 client) mysql 5.0.45-7.el5, mysql-test 5.0.45-7.el5, mysql-bench 5.0.45-7.el5, mysql-server 5.0.45-7.el5 Red Hat Enterprise Linux Desktop Workstation (v. 5 client) mysql 5.0.45-7.el5, mysql-test 5.0.45-7.el5, mysql-bench 5.0.45-7.el5, mysql-server 5.0.45-7.el5
    fixed: vendor fix RHSA-2008:0364

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-28398)
  2. Published

Exploit prediction

13.57% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-28398 MySQL 4/5 - SUID Routine Miscalculation Arbitrary DML Statement Execution remote, 2006-08-17
  • securityfocus.com http://www.securityfocus.com/bid/19559 referenced PoC, tagged "exploit" by a source, unverified
  • bugs.mysql.com http://bugs.mysql.com/bug.php?id=18630 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.