Red Hat Bugzilla – Bug 150871
CAN-2005-0710 MySQL security attacks via user-defined functions in C (CAN-2005-0709)
Last modified: 2013-07-02 23:04:33 EDT
Description of problem:
MySQL allows users with very low privileges to create user-defined
functions that reference code in loadable shared libraries. Obviously
this creates a risk of users being able to cause the server to execute
arbitrary code. There are some rather ad-hoc restrictions intended to
prevent misuse of the feature, but Stefano Di Paola found two
different ways to create problems anyway: you can call an arbitrary
function belonging to any standard system library, and you can
circumvent the check against giving an absolute path to a library.
Reported to vulnwatch.org by Stefano Di Paola on 11 Mar 2005
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. See vulnwatch reports.
This is fixed in 4.1.10a, which we should upgrade to anyway as it
contains numerous other bug fixes.
My personal opinion is that adding more ad-hoc restrictions will never
make this feature secure, and that MySQL will ultimately have to do
something like what PostgreSQL does with their equivalent feature, ie
allow only database superusers to define functions written in C.
We'll need to keep a close eye on this area.
Here is a link to the mysql manual's discussion of security for
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.