Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security vulnerability in MySQL ubuntu

seclists.org

Post reply on HN
Print view View original

111–116 of 116 posts

Re: Security vulnerability in MySQL ubuntu

#111

Post by speleding »

tptacek wrote: post #7

This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .

I agree with the sentiment, but just to be clear: There are valid reasons to allow MySQL to talk to the wider internet, the most important one being off-site replication.

If you do need your mysql to be exposed to the internet you can use bind_address=x.x.x.x or some kind of firewall.

Re: Security vulnerability in MySQL ubuntu

#112

Post by gouranga »

pgeorgi wrote: post #109
gouranga wrote: post #58

Earlier quoted context omitted.

Any more details? Not had any problems on that side of things yet.

Also http://lists.debian.org/debian-devel/2012/04/msg00528.html (but that's just some internal governance tool)

Thanks for link :)

Re: Security vulnerability in MySQL ubuntu

#113

Post by tedunangst »

Negitivefrags wrote: post #46
dangrossman wrote: post #39

Earlier quoted context omitted.

Why would you imagine that? The bug is that what password you provide doesn't matter.

That wasn't how I read it. It sounds like they were casting the result of a memcmp to a char. A char only has a range of -128 to 127. The resulting overflow means that an arbitrary password hash has a 1/255 chance of landing on 0, but you still have to try a bunch to hit one.

The password is combined with a random value on each attempt, the hash will change each time.

Re: Security vulnerability in MySQL ubuntu

#114

Post by mike-cardwell »

tptacek wrote: post #108
mike-cardwell wrote: post #106

Earlier quoted context omitted.

Again, you're completely ignoring shared hosting systems. You have a very strange understanding of what "real-world applications" means when it comes to MySQL.

One term for the applications you're thinking about is "certified pre-owned". Michel Zalewski just made a handy logo for those people to slap on the bottom of their front page: http://lcamtuf.blogspot.com/2012/06/this-page-is-now-certifi...

"In most real-world applications, MySQL authentication and privileges have absolutely no effect on security."

To me, that makes as much sense as:

"In most real-world applications, file permissions have absolutely no effect on security."

Or:

"In most real-world applications, running services under isolated uids instead of running everything as root has absolutely no effect on security."

It's a bold claim, but one made with no evidence to back it up.

Re: Security vulnerability in MySQL ubuntu

#115

Post by mike-cardwell »

tptacek wrote: post #107
mike-cardwell wrote: post #105

Earlier quoted context omitted.

Perhaps you should have been more careful with your wording. It demonstrated a lack of understanding of real world configurations and requirements and implied that if you're doing it that way, you're doing it wrong. I'd guess that most websites live in shared hosting systems. EDIT: You could have just replied to my original comment agreeing with me that shared hosting systems work that way, and that it's ok for certa…

I'm really not sure what you're hoping to have me concede here. If you operate the kind of application that people on HN tend to operate, you should avoid shared hosting. I work with and enjoy talking to people who are serious about running applications, and I provide advice to people who are at least somewhat serious about security. If you don't fit either of those molds, I don't think any less of you, but I'm not g…

You've already conceded the point by completely rewriting your claim.

"If you operate the kind of application that people on HN tend to operate, you should avoid shared hosting."

Is a far cry from:

"Attackers should never, ever be able to connect directly to your MySQL database directly"

That comment was about as useful as:

"Attackers should never, ever be able to enter the data center where your servers are hosted"

Re: Security vulnerability in MySQL ubuntu

#116

Post by willvarfar »

mjschultz wrote: post #81
willvarfar wrote: post #22

I'd love to see the code; quite how they are not comparing a memcmp to 0 would be interesting to see...

Here is the fixed version of the MySQL code: https://bazaar.launchpad.net/~mysql/mysql-server/5.1/view/35... (line 534 didn't have the test()) previously)

yeap, strange; I'd have thought the obvious natural code would have been:

    return 0 == memcmp(hash_stage2, hash_stage2_reassured, SHA1_HASH_SIZE)
As in, return a bool on whether it matched.

I mean, as I read it, the function returns true if they don't match?

Post reply on HN