Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security vulnerability in MySQL ubuntu

seclists.org

Post reply on HN
Print view View original

91–100 of 116 posts

Re: Security vulnerability in MySQL ubuntu

#91

Post by peterwwillis »

mike-cardwell wrote: post #88
tptacek wrote: post #86

Earlier quoted context omitted.

Don't use shared web hosting.

If ever a comment deserved down voting into oblivion, this would be it. Your advice is for everyone that is providing and using shared web hosting, to stop it?

From a security perspective it's good advice. I've never seen a shared web hosting provider whose boxes couldn't be owned by an account that could drop code and execute. Local priv escalation holes seem to be a dime a dozen and you don't know if they've even attempted to lock down their users' data.

Now, do you really care if some community bulletin board's database gets owned? Probably not. But I wouldn't run a shopping cart on a shared hoster.

Re: Security vulnerability in MySQL ubuntu

#92

Post by Apreche »

mmaunder wrote: post #80

Has anyone managed to actually repro this. I've tried it on a wide variety of systems I run and no repro. Just looking for anecdotal data on how many systems are affected. To me it doesn't seem like a high percentage.

I am trying to make it work on my Ubuntu 12.04 VBox VM. I have mysqld Ver 5.5.22-0ubuntu1, which is the supposedly affected version. I can not reproduce it.

I thought at first it might be because I do not have a root password (it's a VM) so trying to use any password at all returns a failure before the faulty code is reached. Then I tried to login as debian-sys-maint and some other users that do have passwords, and it still did not work.

Re: Security vulnerability in MySQL ubuntu

#93

Post by postfuturist »

drivebyacct2 wrote: post #63
jontas wrote: post #16

Just tried the various one-liners mentioned in the comments on a hardy (8.04) release using mysql 5.0.51a and could not get in. This is a slicehost box, so I'm assuming that can be extrapolated to mean that anyone using ubuntu on slicehost is probably safe.

That's a horrid assumption, is verifiably wrong and what in God's name are you doing on Hardy? You just screamed "ignore me" three times in two sentences.

I'm not the poster, but Hardy is an LTS release that is still supported in server configuration. It's quite a bit newer than Centos/RHEL 5, which is widely deployed on servers (potentially the most popular platform for existing deployments, still).

Re: Security vulnerability in MySQL ubuntu

#94

Post by mike-cardwell »

tptacek wrote: post #90
mike-cardwell wrote: post #88

Earlier quoted context omitted.

If ever a comment deserved down voting into oblivion, this would be it. Your advice is for everyone that is providing and using shared web hosting, to stop it?

If you're using it for a real application, I'd move. Sorry if that makes you feel bad.

I'm not using shared hosting, no. Although I did work for a company that provided it a few years back. I'm just trying to figure out if you're actually being serious with your claim that everyone with a database backed website should be running it from isolated servers? If you actually understand the implications of this or if you're just making nonsensical off the cuff remarks? I wonder how many tens or hundreds of millions of servers that would add to the Internet.

Re: Security vulnerability in MySQL ubuntu

#95

Post by mike-cardwell »

peterwwillis wrote: post #91
mike-cardwell wrote: post #88

Earlier quoted context omitted.

If ever a comment deserved down voting into oblivion, this would be it. Your advice is for everyone that is providing and using shared web hosting, to stop it?

From a security perspective it's good advice. I've never seen a shared web hosting provider whose boxes couldn't be owned by an account that could drop code and execute. Local priv escalation holes seem to be a dime a dozen and you don't know if they've even attempted to lock down their users' data. Now, do you really care if some community bulletin board's database gets owned? Probably not. But I wouldn't run a shop…

"Now, do you really care if some community bulletin board's database gets owned? Probably not. But I wouldn't run a shopping cart on a shared hoster."

I agree. tptacek is the one who disagrees with you. He thinks there is "never" a good reason to use shared hosting.

Re: Security vulnerability in MySQL ubuntu

#96

Post by jaryd »

tptacek wrote: post #7

This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .

metasploit module:

https://github.com/rapid7/metasploit-framework/blob/master/m...

Re: Security vulnerability in MySQL ubuntu

#97

Post by mjschultz »

Apreche wrote: post #92
mmaunder wrote: post #80

Has anyone managed to actually repro this. I've tried it on a wide variety of systems I run and no repro. Just looking for anecdotal data on how many systems are affected. To me it doesn't seem like a high percentage.

I am trying to make it work on my Ubuntu 12.04 VBox VM. I have mysqld Ver 5.5.22-0ubuntu1, which is the supposedly affected version. I can not reproduce it. I thought at first it might be because I do not have a root password (it's a VM) so trying to use any password at all returns a failure before the faulty code is reached. Then I tried to login as debian-sys-maint and some other users that do have passwords, and i…

I couldn't get it to reproduce on a VM (VirtualBox) either. I'm wondering if the SSE-optimized version of the glibc doesn't work the same way in a VM as it does on host hardware (i.e. SSE instructions are virtualized to some degree). Since the hardware doesn't support it, the library falls back to a version that won't trigger the bug.

(Again, this is just an unconfirmed theory.)

Re: Security vulnerability in MySQL ubuntu

#98

Post by tptacek »

mike-cardwell wrote: post #94
tptacek wrote: post #90

Earlier quoted context omitted.

If you're using it for a real application, I'd move. Sorry if that makes you feel bad.

I'm not using shared hosting, no. Although I did work for a company that provided it a few years back. I'm just trying to figure out if you're actually being serious with your claim that everyone with a database backed website should be running it from isolated servers? If you actually understand the implications of this or if you're just making nonsensical off the cuff remarks? I wonder how many tens or hundreds of…

Of course I'm being serious. Don't run serious applications from the shared MySQL databases at shared hosting providers. You seem shocked that I'm saying this, but we work with a lot of very young startups and I have never met one running their app off a Dreamhost-style shared server.

Tens or hundreds of millions of database servers? That's hyperbolic.

Do you really think that we've come close to eliminating all the vulnerabilities inside a MySQL session, post-authentication? Because what you're arguing is effectively that application owners should trust that MySQL is resilient against attackers who can get an authenticated handle to their own database and run nearly arbitrary SQL statements against it. You think all the code in the MySQL query parser, the planner, and the various storage backends have been fully audited? This is a project that didn't even get authentication right.

Re: Security vulnerability in MySQL ubuntu

#99

Post by tptacek »

peterwwillis wrote: post #91
mike-cardwell wrote: post #88

Earlier quoted context omitted.

If ever a comment deserved down voting into oblivion, this would be it. Your advice is for everyone that is providing and using shared web hosting, to stop it?

From a security perspective it's good advice. I've never seen a shared web hosting provider whose boxes couldn't be owned by an account that could drop code and execute. Local priv escalation holes seem to be a dime a dozen and you don't know if they've even attempted to lock down their users' data. Now, do you really care if some community bulletin board's database gets owned? Probably not. But I wouldn't run a shop…

If you don't really care about security --- and I agree there are times when you shouldn't --- then by all means use the cheapest possible hosting option available to you. But if you care even a little about security, avoid shared hosting.

I really don't understand Mike Cardwell's objection; I don't think what I'm saying is controversial at all. I actually thought I was making a relatively banal point.

Re: Security vulnerability in MySQL ubuntu

#100

Post by tptacek »

mmaunder wrote: post #64
mike-cardwell wrote: post #60

Earlier quoted context omitted.

"Never" ... You are aware of the existence and mass use of shared web hosting systems right?

Right. By this logic MySQL doesn't need authentication, never mind privileges.

Honestly? In most real-world applications, MySQL authentication and privileges have absolutely no effect on security.
Post reply on HN