Bug #55700 I can CREATE TABLE ... LIKE without any privilege
Submitted: 2 Aug 2010 23:29 Modified: 3 Aug 2010 8:16
Reporter: Andrey Lipatov Email Updates:
Status: Not a Bug Impact on me:
None 
Category:MySQL Server: Security: Privileges Severity:S3 (Non-critical)
Version:5.0 OS:Windows
Assigned to: CPU Architecture:Any

[2 Aug 2010 23:29] Andrey Lipatov
Description:
A user can create a table using CREATE...LIKE even when he doesn't have any privileges on the source table.

MySQL used to work correctly few days ago and CREATE...LIKE failed as expected, but now it always succeeds. I can't figure out why. 
MySQL on my another Windows machine works fine

How to repeat:
as root:
create database test_db;
GRANT ALL privileges on test_db.* to 'test_db_user'@'%' identified by 'test_pwd';

as test_db_user:

use test_db;
create table test like any_other_database.table_name;

The CREATE TABLE unexpectedly succeeds
[2 Aug 2010 23:45] MySQL Verification Team
Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://dev.mysql.com/doc/ and the instructions on
how to report a bug at http://bugs.mysql.com/how-to-report.php

http://dev.mysql.com/doc/refman/5.0/en/unix-post-installation.html

"...initially. Section 2.18.3, “Securing the Initial MySQL Accounts”, describes the initial privileges. Briefly, these privileges permit the MySQL root user to do anything, and permit anybody to create or use databases with a name of test or starting with test_."
[3 Aug 2010 8:16] Andrey Lipatov
Thank you for replay. I didn't know about special treaing of "test_" db, however I am getting the described error with ANY destination and source databases. 
E.g. originally i got the error with the following database:

as root:
create database slave1_db;
GRANT ALL privileges on slave1_db.* to slave1_db_user'@'%' identified by 'xxxxxx';

as slave1_db_user:

use slave1_db;
create table my_table like base_tmpl_db.my_table;

So, destination or source database names, username and table names can be arbitrary. Result is always the same.

Thanks