DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defenses. For the attack to succeed, the following factors need to contribute: 1) The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user. 2) The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack. This has been fixed in version 1.58.2.

Threat-Mapped Scoring

Score: 1.8

Priority: P4 - Informational (Low)

• S9 – Sabotage of System/App

EPSS

Score: 0.00304
Percentile: 0.53209

CVSS Scoring

Mapped CWE(s)

• CWE-59 : Improper Link Resolution Before File Access ('Link Following')

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1547.009 : Shortcut Modification
  Kill Chain: persistence
• T1574.005 : Executable Installer File Permissions Weakness
  Kill Chain: persistence
• T1574.010 : Services File Permissions Weakness
  Kill Chain: persistence
• T1027.006 : HTML Smuggling
  Kill Chain: defense-evasion
• T1027.009 : Embedded Payloads
  Kill Chain: defense-evasion
• T1564.009 : Resource Forking
  Kill Chain: defense-evasion

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:dbdeployer:dbdeployer:*:*:*:*:*:*:*:*

← Back to Home