oss-security - Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFB=mGDg+UN7=w7Ve1BC8cXQXRHuzYgBdufUJKj6y5-Tp=Fmqw@mail.gmail.com>
Date: Mon, 3 Dec 2012 16:52:55 +0100
From: king cope <isowarez.isowarez.isowarez@...glemail.com>
To: oss-security@...ts.openwall.com, Kurt Seifried <kseifried@...hat.com>, 
	king cope <isowarez.isowarez.isowarez@...glemail.com>, 
	full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com, 
	todd@...ketstormsecurity.org, submit@...sec.com, 
	Mitre CVE assign department <cve-assign@...re.org>, Steven Christey <coley@...re.org>, security@...iadb.org, 
	security@...ql.com, Ritwik Ghoshal <ritwik.ghoshal@...cle.com>, moderators@...db.org
Subject: Re: Re: [Full-disclosure] MySQL (Linux) Stack based
 buffer overrun PoC Zeroday

Yes you are way right.
Don't patch it!

2012/12/3 Sergei Golubchik <serg@...monty.org>:
> Hi, king cope!
>
> On Dec 02, king cope wrote:
>> Hi,
>> My opinion is that the FILE to admin privilege elevation should be
>> patched.  What is the reason to have FILE and ADMIN privileges
>> seperated when with this exploit FILE privileges equate to ALL ADMIN
>> privileges.
>> I understand that it's insecure to have FILE privileges attached to a
>> user.  But if this a configuration issue and not a vulnerability then
>> as stated above there must be something wrong with the privilege
>> management in this SQL server.
>
> You've missed that part of my reply:
>
>> > Additionally, MySQL (and MariaDB) provides a --secure-file-priv
>> > option that allows to restrict all FILE operations to a specific
>> > directory.
>
> Normally, if a DBA wants to grant FILE privilege to users, the server
> will have something like secure-file-priv=/tmp/mysql (for example)
> specified in the configuration file. This way any operation allowed by
> the FILE privilege (like SELECT ... OUTFILE) will only be able to access
> files under the /tmp/mysql/ path.
>
> Regards,
> Sergei
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.