11–20 of 116 posts
Earlier quoted context omitted.
Try to connect to MySQL as root with a made-up password several hundred times. If you successfully connect, the bug is present and you know how it was compiled.
where is the perl one-liner :P?
Whether a particular build of MySQL or MariaDB is vulnerable, depends on how and where it was built. A prerequisite is a memcmp() that can return an arbitrary integer (outside of -128..127 range). To my knowledge gcc builtin memcmp is safe, BSD libc memcmp is safe. Linux glibc sse-optimized memcmp is not safe, but gcc usually uses the inlined builtin version. How do you know, how the Ubuntu devs compiled their mysql…
But, that is just my single VM instance and I would assume HD Moore knows what he is doing.
This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .
mySQLgame[1] demonstrates that domain logic can be successfully implemented within a publicly accessible database[2]. It would be better to reword your statement to:
Minimise the attack surface by preventing unnecessary access
There are times where public access to a database server make perfect sense. It is the reason why database servers implement TLS client certificate verification, Role Based Access Control (RBAC) and other security features which a typical application (with domain logic at the application layer) has no hope of implementing correctly.
This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .
―Attackers should never, ever be able to connect directly to your MySQL database directly. mySQLgame[1] demonstrates that domain logic can be successfully implemented within a publicly accessible database[2]. It would be better to reword your statement to: Minimise the attack surface by preventing unnecessary access There are times where public access to a database server make perfect sense. It is the reason why data…
In any case, the typical web app deployed by HN readers has no business having an exposed MySQL port.
Here's a guide for limiting access to it by IP address via the apache config for Ubuntu users:
http://mixeduperic.com/ubuntu/how-to-restrict-phpmyadmin-ip-...
This is a slicehost box, so I'm assuming that can be extrapolated to mean that anyone using ubuntu on slicehost is probably safe.
Whether a particular build of MySQL or MariaDB is vulnerable, depends on how and where it was built. A prerequisite is a memcmp() that can return an arbitrary integer (outside of -128..127 range). To my knowledge gcc builtin memcmp is safe, BSD libc memcmp is safe. Linux glibc sse-optimized memcmp is not safe, but gcc usually uses the inlined builtin version. How do you know, how the Ubuntu devs compiled their mysql…
Well, the Ubuntu part came from HD Moore [1]. I haven't been able to confirm it on my Ubuntu 12.04 virtual machine instance though, nor does my virtual machine appear to trigger the bug using the CVE-2012-2122 checker [2]. But, that is just my single VM instance and I would assume HD Moore knows what he is doing. [1] http://pastie.org/private/903voijkkz8nmde3yqj4rw [2] http://pastie.org/4064638
This is a serious vulnerability. Especially since the latest ubuntu seems to be affected(I'm on mint 13, and it is)
See Ready shodanhq query for latest mysql version:
http://www.shodanhq.com/search?q=port%3A3306+5.5.22-0ubuntu1