[UNIX] MySQL Insecure Temporary File Handling

From: SecuriTeam (support_at_securiteam.com)
Date: 05/19/05

  • Next message: SecuriTeam: "[EXPL] cdrdao Insecure File Handling (Exploit)" 
    To: list@securiteam.com
Date: 19 May 2005 16:23:43 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      MySQL Insecure Temporary File Handling
    ------------------------------------------------------------------------

    SUMMARY

    "The <http://www.mysql.com> MySQL database server is the world's most
    popular open source database."

    MySQL handle temporary files in an unsafe way while creating new database,
    allowing a malicious attacker to inject arbitrary SQL commands.

    DETAILS

    Vulnerable Systems:
     * MySQL versions 4.0.11 and prior
     * MySQL versions 5.0.4 and prior

    Immune Systems:
     * MySQL version 4.0.12

    MySQL contain a security flaw that could allow a malicious local attacker
    to inject arbitrary SQL commands during database creation process.

    For example:
    A malicious local attacker could create an mysql account accessible from
    local (or everywhere) with ALL privileges on all databases.

    Example:
    tmp_file=/tmp/mysql_install_db.$$

    Then on:
    226> echo "use mysql;" > $tmp_file
    227> cat $tmp_file $fill_help_tables | eval "$mysqld_install_cmd_line"
    228> res=$?
    229> rm $tmp_file

    Patch Availability:
    MySQL versions 5.* is still vulnerable.

    Disclosure Timeline:
    07.05.05 - Vulnerability discovered
    09.05.05 - Vendor notified
    09.05.05 - Vendor response
    17.05.05 - Vendor published fix
    17.05.05 - Disclosure

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:exploits@zataz.net>
    ZATAZ.net.
    The original article can be found at:
    <http://www.zataz.net/adviso/mysql-05172005.txt>
    http://www.zataz.net/adviso/mysql-05172005.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] cdrdao Insecure File Handling (Exploit)"

    Relevant Pages

    • [REVS] Blind Injection in MySQL Databases (via BENCHMARK)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... MySQL is not an easy database for Blind SQL Injection: ... inside the query itself. ... we find an injection vulnerability that is not ...
      (Securiteam)
    • [UNIX] Buffer Overflow in MySQL (PASSWORD)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... MySQL is "the world's most popular open source ... database, recognized for its speed and reliability. ... This could be because you hit a bug. ...
      (Securiteam)
    • [EXPL] MySQL Authentication Bypass Exploit
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... An authentication vulnerability was reported in our previous article, ... MySQL Authentication ... # break the username string into chars and rebuild it ...
      (Securiteam)
    • [REVS] New SQL Injection Concept (Comments, 9e999, MySQL Specific)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The examples below use MySQL because it seems to be most used database on ... This can be extremely useful for penetration tester to find out database ...
      (Securiteam)
    • [NT] MySQL UDF Multiple Vulnerabilities (Directory Traversal, DoS, Arbitrary Library Including, Buff
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... length validation allow attackers to execute arbitrary code using MySQL ... Improper directory separator checking, allow attacker to perform ... MySQL attempts to filter execution of arbitrary libraries by requiring any ...
      (Securiteam)