it occured to me (while brushing my teeth in fact :)) that this may be something that has to be patched in the query-parser instead, since the solution i'm talking about will break if the user decide to build from a custom libmysql-installation.

Thank you for your report!

The BugTraq advisory is spurious. Issues of this nature 
can be avoided by revoking the FILE permission of the 
database user.

Review:
http://www.mysql.com/doc/M/y/MySQL_Database_Administration.html
http://www.mysql.com/doc/P/r/Privilege_system.html

while that would be a obvious solution, this is an CLIENT-matter (the client sends the file) - and the File-privilege is only affecting the ability to load files that are stored on the server (and not in the client). The problem discussed is in the way that PHP will allow for any user to upload an arbitary file form the local server (where php runs) to the MySQL-server.

IE: I set up a server running MySQL (or faking it, whatever) .. which just implements the receiver-part of the send_file_to_server-function in libmysql. This will allow me to transfer any file that the user PHP runs under on the server has access to, regardless of safe_mode, etc.

The keyword 'local' is probably the cause of confusion, since this causes the file to be loaded from the client - and not the server (where the File-privilege has effect).

Humility is a dish best served lukewarm... I should have read more carefully. :)

While Rasmus has spoken on this issue, but I will take a closer look at it tomorrow.

Verified that the exploit allows any file readable by the 
MySQL server to be viewed via this technique. Note that 
forbidding the MySQL user CREATE permission does make the 
exploit less convenient for the attacker.

The MySQL dev team is looking at ways to reduce this risk 
via MySQL permission behavior in the server.

Given Rasmus' feedback on the issue, I am closing this as 
a PHP bug. Hopefully, the MySQL dev team should be able 
eliminate or reduce this risk. If we can't completely 
resolve it, I will re-examine this bug.

--zak@[mysql|php].com

Verified that the exploit allows any file readable by the 
MySQL server to be viewed via this technique. Note that 
forbidding the MySQL user CREATE permission does make the 
exploit less convenient for the attacker.

The MySQL dev team is looking at ways to reduce this risk 
via MySQL permission behavior in the server.

Given Rasmus' feedback on the issue, I am closing this as 
a PHP bug. Hopefully, the MySQL dev team should be able 
eliminate or reduce this risk. If we can't completely 
resolve it, I will re-examine this bug.

--zak@[mysql|php].com

It works even if you are connecting to remote mysql server over tcp/ip, so I don't think this is only mysql related issue.

I generally agree on Rasmus' feedback on the issue, so i'll leave it closed. However, since this naturally works with remote mysql-servers, setting up a server where you have the create-permission isnt really much of a hazzle.

A fix for this behavior should appear within the next few 
releases of the MySQL 4.0.x series.

I will update this bug when the fix is implemented.

I should re-examine this one as well. 

This problem is already closed. Bundled libmysql doesn't support local anymore.