[VulnWatch] [AppSecInc Advisory MYSQL05-V0001] Improper Filtering of Directory Traversal Characters in MySQL User Defined Functions

From: Team SHATTER (shatter_at_appsecinc.com)
Date: 08/09/05

  • Next message: iDEFENSE Labs: "[VulnWatch] iDEFENSE Security Advisory 08.09.05: AWStats ShowInfoURL Remote Command Execution Vulnerability" 
    Date: Mon, 08 Aug 2005 18:43:02 -0400
To: bugtraq@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
     
    Improper Filtering of Directory Traversal Characters in MySQL User
    Defined Functions

    AppSecInc Team SHATTER Security Advisory MYSQL05-V0001
    http://www.appsecinc.com/resources/alerts/mysql/2005-001.html
    August 08, 2005

    Risk level: LOW

    Credits: This vulnerability was discovered and researched by Reid
    Borsuk of Application Security Inc.

    Affected Versions:
    ALL

    Background:
    User-defined functions in MySQL allow a user in the database to call
    binary libraries on the operating system. Creating a user-defined
    function requires insert privileges on the mysql.func table.

    Details:
    The UDF creation functions attempt to filter out directory traversal
    characters, restricting access to libraries only in system and MySQL
    directories.

    The problem exists in the fact that MySQL only uses the forward slash
    (/) as a path separator. Windows machines use the backslash (\)
    character to separate directories in paths. This allows an attacker to
    bypass directory traversal checks and include arbitrary files.

    This may allow an attacker to execute arbitrary code if they are able
    to drop a file either through FILE privileges, or other attacks on
    MySQL or other programs.

    It should be noted that this is a Windows specific issue; other
    operating systems are not likely to be affected.

    Exploiting this vulnerability would require the ability to create
    user-defined functions. This is not typically granted to untrusted
    users, however given this vulnerability you should understand the
    ramifications of granting the ability to create user-defined functions.

    Workaround:
    Restrict access to create user-defined functions.

    Vendor Status:
    Vendor was contacted and a patch was released.

    Fix:
    MySQL versions 4.0.25, 4.1.13, or 5.0.7-beta have been patched. These
    products can be found here:
    http://dev.mysql.com/downloads/

    Links:
    Application Security, Inc advisory:
    http://www.appsecinc.com/resources/alerts/mysql/2005-001.html

    - --
    _____________________________________________
    Application Security, Inc.
    www.appsecinc.com
    AppSecInc is the leading provider of database security solutions for
    the enterprise. AppSecInc products proactively secure enterprise
    applications at more than 300 organizations around the world by
    discovering, assessing, and protecting the database against rapidly
    changing security threats. By securing data at its source, we enable
    organizations to more confidently extend their business with
    customers, partners and suppliers. Our security experts, combined with
    our strong support team, deliver up-to-date application safeguards
    that minimize risk and eliminate its impact on business.

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.0 (MingW32)
     
    iD8DBQFC99/2/0w1dSVRt4URAmVxAJ9M2r5gJ/uKLWYIY9NcntejOxgC2wCghTRl
    fuwiXpRItP5qp72kIWKH3vY=
    =vBK4
    -----END PGP SIGNATURE-----

  • Next message: iDEFENSE Labs: "[VulnWatch] iDEFENSE Security Advisory 08.09.05: AWStats ShowInfoURL Remote Command Execution Vulnerability"

    Relevant Pages