MySQL gains new batch of vulns
Overruns, privileges, DoS and more
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
A series of posts on ExploitDB by an author signing as “King Cope” reveal a new set of MySQL vulnerabilities – along with one issue that could just be a configuration issue.
The vulnerabilities, which emerged on Saturday, include a denial-of-service demonstration, a Windows remote root attack, two overrun attacks that work on Linux, and one privilege escalation attack, also on Linux.
The overflow bugs crash the MySQL daemon, allowing the attacker to then execute commands with the same privileges as the user running MySQL. “King Cope” also demonstrated a user enumeration vulnerability.
The privilege escalation vulnerability, in which an attacker could escalate themselves to the same file permissions as the MySQL administrative user, has provoked some to-and-fro on the Full Disclosure mailing list, with one writer stating that “CVE-2012-5613 is not a bug, but a result of a misconfiguration, much like an anonymous ftp upload access to the $HOME of the ftp user.”
Red Hat has assigned CVEs to the vulnerabilities, but at the time of writing, Oracle has not commented on the issues. ®
COMMENTS
File System Permissions
If you've given users the ability to write to your mysql database directory, you've already pissed up. A sane setup should be protected from that by default. Never write anything in to the same directory that someone else can, too many opportunities for race conditions and other timing attacks.
The heap and stack attack look like they could be kind of dangerous, hack in a poorly protected site on your server, get credentials to your sql server, then dump password tables for other sites. Could see a few more big sites password lists get in the wild from this.
Re: File System Permissions
Postgresql comes to mind also
Re: File System Permissions
If you already have access to the mysql user, and can write files owned by mysql, the ability to make a database user have full admin access is rather unsurprising.
Privalege escalation is not privalege escalation when you need privs higher or equal to the privs you are attempting to aquire.
The mysql user is a higher privalege than any database user account.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
