Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security vulnerability in MySQL ubuntu

seclists.org

Post reply on HN
Print view View original

81–90 of 116 posts

Re: Security vulnerability in MySQL ubuntu

#81

Post by mjschultz »

willvarfar wrote: post #22

I'd love to see the code; quite how they are not comparing a memcmp to 0 would be interesting to see...

Here is the fixed version of the MySQL code: https://bazaar.launchpad.net/~mysql/mysql-server/5.1/view/35... (line 534 didn't have the test()) previously)

Re: Security vulnerability in MySQL ubuntu

#83

Post by mjschultz »

mmaunder wrote: post #80

Has anyone managed to actually repro this. I've tried it on a wide variety of systems I run and no repro. Just looking for anecdotal data on how many systems are affected. To me it doesn't seem like a high percentage.

Here is the reference from the Ubuntu CVE tracker: https://bugs.launchpad.net/bugs/cve/2012-2122. So yes it looks like it is confirmed.

Also, the associated bug report: https://bugs.launchpad.net/ubuntu/+source/mysql-5.5/+bug/101....

Re: Security vulnerability in MySQL ubuntu

#84

Post by pwaring »

mmaunder wrote: post #80

Has anyone managed to actually repro this. I've tried it on a wide variety of systems I run and no repro. Just looking for anecdotal data on how many systems are affected. To me it doesn't seem like a high percentage.

I can reproduce it on my Ubuntu laptop (amd64 precise), so it definitely exists.

Re: Security vulnerability in MySQL ubuntu

#85

Post by rominet »

It seems that SSE4 extensions are needed to be vulnerable, otherwise memcmp() is doing classical computations.

So you need a 64 bits system, and be sure that you are not using a virtualisation system which does clear SSSE4 flag in /proc/cpuinfo (VirtualBox does).

Re: Security vulnerability in MySQL ubuntu

#86

Post by tptacek »

mike-cardwell wrote: post #60
tptacek wrote: post #7

This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .

"Never" ... You are aware of the existence and mass use of shared web hosting systems right?

Don't use shared web hosting.

Re: Security vulnerability in MySQL ubuntu

#87

Post by tptacek »

halayli wrote: post #38
tptacek wrote: post #7

This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .

With this logic, let's not secure any software that you cannot connect to it directly.

What "logic" is this? Where are people getting the idea that I'm instructing them not to patch MySQL?

Re: Security vulnerability in MySQL ubuntu

#88

Post by mike-cardwell »

tptacek wrote: post #86
mike-cardwell wrote: post #60

Earlier quoted context omitted.

"Never" ... You are aware of the existence and mass use of shared web hosting systems right?

Don't use shared web hosting.

If ever a comment deserved down voting into oblivion, this would be it.

Your advice is for everyone that is providing and using shared web hosting, to stop it?

Re: Security vulnerability in MySQL ubuntu

#90

Post by tptacek »

mike-cardwell wrote: post #88
tptacek wrote: post #86

Earlier quoted context omitted.

Don't use shared web hosting.

If ever a comment deserved down voting into oblivion, this would be it. Your advice is for everyone that is providing and using shared web hosting, to stop it?

If you're using it for a real application, I'd move.

Sorry if that makes you feel bad.

Post reply on HN