Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security vulnerability in MySQL ubuntu

seclists.org

Post reply on HN
Print view View original

51–60 of 116 posts

Re: Security vulnerability in MySQL ubuntu

#51

Post by einhverfr »

halayli wrote: post #38
tptacek wrote: post #7

This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .

With this logic, let's not secure any software that you cannot connect to it directly.

Before we forked LedgerSMB, the SQL-Ledger author's attitude was that unless you can exploit the software without logging in it doesn't count. It's only accounting software anyway so why would anyone want to break in? Not only that but timestamps were perfectly acceptable as session id's and they didn't even have to be stored on the server, just checked to see if they were recent.

Thus began years of efforts on our part of security fixes, which I would not have started except that I had customers to support.

Re: Security vulnerability in MySQL ubuntu

#52

Post by einhverfr »

tedunangst wrote: post #23

From the mysql commit: Date: 2012-04-06 09:04:07 UTC That's two months ago. Looking at the changelog ( http://dev.mysql.com/doc/refman/5.1/en/news-5-1-63.html ), they piled in a bunch of other changes like "use less disk space". This should have gone out pronto . I feel it's not the kind of thing you sit on until your next quarterly release is scheduled. [oh wait, this is worse. mysql 5.1.63 was actually released a m…

wow.....

What ever happened to public disclosure as soon as a patch is released?

I have been bit twice by problems relating to difficulties getting security fixes/announcements out in time. In my defence I was trying to patch a difficult codebase and this just took a long time. For example, there was a full SQL injection audit that took us two months to complete early on, and there was an issue of XSRF vulnerabilities which could not be effectively patched in a production release.

But waiting a month to announce the security issue after the release was out strikes me as hard to justify.

Re: Security vulnerability in MySQL ubuntu

#53

Post by vladd »

darklajid wrote: post #36
captn3m0 wrote: post #19

So if I try logging in with phpmyadmin 256 times, will I succeed?

Maybe. If you roll a dice 6 times, will one result be a 6?

The probably of NOT hitting a 6 value even after six throws is:

(5/6)^6 = 0.335

For the original question:

(255/256)^256 = 0.367

so yes, you'll succeed in 63.3% of the cases.

Re: Security vulnerability in MySQL ubuntu

#54

Post by pgeorgi »

gouranga wrote: post #50
viraptor wrote: post #45

Earlier quoted context omitted.

Why migrate to a completely different environment? I'd recommend just installing some version of percona server (mySQL flavour) instead. You get both better software and upstream version instead of a repackaged one.

It was what was there as a piece of duct tape for the minute. I'm in the process of binning it all and moving to Debian which is actually trustworthy...

except that they try to optimize randomness in security libraries every now and then.

Re: Security vulnerability in MySQL ubuntu

#55

Post by rlpb »

It looks like this is being tracked in Ubuntu here: https://bugs.launchpad.net/bugs/1011371

Unfortunately Oracle's stewardship of MySQL appears to be a closed model. There is no public access to their bug tracker, and distributions struggle to keep up with security updates because the details of their fixes in the source are not published. The future of MySQL appears to be in one of the MySQL forks.

See https://lists.ubuntu.com/archives/ubuntu-server/2012-Februar... and https://lists.ubuntu.com/archives/ubuntu-server/2012-Februar... for details.

Re: Security vulnerability in MySQL ubuntu

#56

Post by air »

gouranga wrote: post #41

Doesn't surprise me. Ubuntu always ship fucked up, broken, shitty MySQL versions. Look at the one that is current HEAD on 10.04 LTS. It's got so much broken stuff in it, we had to move everything to a spare windows machine where we could stick a later version on without screwing up the machine (DBs for: team city, jira, crucible).

It's squarely a MySQL bug, you can't put any blame on Ubuntu here.

Re: Security vulnerability in MySQL ubuntu

#57

Post by gouranga »

air wrote: post #56
gouranga wrote: post #41

Doesn't surprise me. Ubuntu always ship fucked up, broken, shitty MySQL versions. Look at the one that is current HEAD on 10.04 LTS. It's got so much broken stuff in it, we had to move everything to a spare windows machine where we could stick a later version on without screwing up the machine (DBs for: team city, jira, crucible).

It's squarely a MySQL bug, you can't put any blame on Ubuntu here.

It is but they've fixed it in MySQL and Ubuntu have pinned the HEAD mysql build to the broken one and have pretty much stopped supporting it. LTS my arse.

Re: Security vulnerability in MySQL ubuntu

#58

Post by gouranga »

pgeorgi wrote: post #54
gouranga wrote: post #50

Earlier quoted context omitted.

It was what was there as a piece of duct tape for the minute. I'm in the process of binning it all and moving to Debian which is actually trustworthy...

except that they try to optimize randomness in security libraries every now and then.

Any more details? Not had any problems on that side of things yet.

Re: Security vulnerability in MySQL ubuntu

#59

Post by michiel3 »

Alan01252 wrote: post #35
zzzzzzzzz wrote: post #17

Earlier quoted context omitted.

I can confirm. Ubuntu 12.04 LTS (64 bit).

The C script is returning vulnerable on both my local machine (precise) and my vps (Ubuntu 11.10). However tests of trying to brute force the root password using the mysql one liners in this thread have failed every time. Both machines allow local access only so I assume I'm safe.

Yep, if you're blocking remote hosts to authenticate on 3306 (or any other port you're running mysqld on) you're safe. The attacking host can't authenticate itself, so it's unable to exploit this bug.

Re: Security vulnerability in MySQL ubuntu

#60

Post by mike-cardwell »

tptacek wrote: post #7

This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .

"Never" ... You are aware of the existence and mass use of shared web hosting systems right?
Post reply on HN