Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security vulnerability in MySQL ubuntu

seclists.org

Post reply on HN
Print view View original

21–30 of 116 posts

Re: Security vulnerability in MySQL ubuntu

#21

Post by dhx »

captn3m0 wrote: post #18

This is also important in other environments, for instance shared hosting where you may connect to localhost, or places where you may have given non-admin shell access to a developer (assuming they could not connect to mysql root user). This is a serious vulnerability. Especially since the latest ubuntu seems to be affected(I'm on mint 13, and it is) See Ready shodanhq query for latest mysql version: http://www.shoda…

This vulnerability could also assist with local privilege escalation. If an attacker managers to use a vulnerability in a web application to execute code as a web user account, they can likely access the MySQL server instance via the loopback interface (perhaps a Unix domain socket too?).

Re: Security vulnerability in MySQL ubuntu

#23

Post by tedunangst »

From the mysql commit: Date: 2012-04-06 09:04:07 UTC

That's two months ago. Looking at the changelog (http://dev.mysql.com/doc/refman/5.1/en/news-5-1-63.html), they piled in a bunch of other changes like "use less disk space". This should have gone out pronto. I feel it's not the kind of thing you sit on until your next quarterly release is scheduled.

[oh wait, this is worse. mysql 5.1.63 was actually released a month ago. But they only now tell us what the security bug was? Meanwhile the bad people have had a month to diff sources? Double unhappy.]

Re: Security vulnerability in MySQL ubuntu

#24

Post by tedunangst »

willvarfar wrote: post #22

I'd love to see the code; quite how they are not comparing a memcmp to 0 would be interesting to see...

There is a check_scramble function which returns a my_bool, presumably a char typedef. That function itself directly returns the result of memcmp. If your memcmp implementation returns the full range of int values (allowed), 1/256 of them will have a 0 low order byte, which will then compare equal to zero when the check_scramble call is tested.

This is why real C programmers use int as their bool type. :)

Re: Security vulnerability in MySQL ubuntu

#25

Post by mattbee »

I've been trying this on lots of our customers' boxes and can't exploit it - no matter how many times I've tried I always get turned away when retrying root's password, e.g. trying "while true; do mysql -u root mysql --password=baha; done" does not yield access on any of:

Debian lenny 32-bit 5.0.51a-24+lenny5

Debian lenny 64-bit 5.0.51a-24+lenny5

Debian lenny 64-bit 5.1.51-1-log

Debian squeeze 64-bit 5.1.49-3-log

Debian squeeze 32-bit 5.1.61-0+squeeze1

Debian squeeze 64-bit 5.1.61-0+squeeze1

Ubuntu lucid 64-bit 5.1.62-0ubuntu0.10.04.1

So I'm not inclined to think it's as bad as made out by the simple exploit above.

Re: Security vulnerability in MySQL ubuntu

#27

Post by darnaut »

tedunangst wrote: post #24
willvarfar wrote: post #22

I'd love to see the code; quite how they are not comparing a memcmp to 0 would be interesting to see...

There is a check_scramble function which returns a my_bool , presumably a char typedef. That function itself directly returns the result of memcmp . If your memcmp implementation returns the full range of int values (allowed), 1/256 of them will have a 0 low order byte, which will then compare equal to zero when the check_scramble call is tested. This is why real C programmers use int as their bool type. :)

> This is why real C programmers use int as their bool type. :)

It has the same problem if a wider type (e.g. long) is assigned to it. Use _Bool instead.

Re: Security vulnerability in MySQL ubuntu

#28

Post by tedunangst »

darnaut wrote: post #27
tedunangst wrote: post #24

Earlier quoted context omitted.

There is a check_scramble function which returns a my_bool , presumably a char typedef. That function itself directly returns the result of memcmp . If your memcmp implementation returns the full range of int values (allowed), 1/256 of them will have a 0 low order byte, which will then compare equal to zero when the check_scramble call is tested. This is why real C programmers use int as their bool type. :)

> This is why real C programmers use int as their bool type. :) It has the same problem if a wider type (e.g. long) is assigned to it. Use _Bool instead.

I was at first tempted to complain about useless pedantry, but you're right. Even if some of us still like to party like it's 1989. I should have said the real lesson is don't reimplement standard C types, poorly.

Re: Security vulnerability in MySQL ubuntu

#29

Post by tedunangst »

dfc wrote: post #26

Is the bug limited to ubuntu?

The bug is most definitely in mysql. Its manifestation depends on compiler/library, and it appears ubuntu is the most prominent afflicted platform, but there could be others. Relying on the bug being limited is very thin ice.

Re: Security vulnerability in MySQL ubuntu

#30

Post by Negitivefrags »

mattbee wrote: post #25

I've been trying this on lots of our customers' boxes and can't exploit it - no matter how many times I've tried I always get turned away when retrying root's password, e.g. trying "while true; do mysql -u root mysql --password=baha; done" does not yield access on any of: Debian lenny 32-bit 5.0.51a-24+lenny5 Debian lenny 64-bit 5.0.51a-24+lenny5 Debian lenny 64-bit 5.1.51-1-log Debian squeeze 64-bit 5.1.49-3-log Deb…

I would imagine you have to try a different password each time.
Post reply on HN