Bug 151051 - CAN-2005-0710 MySQL security attacks via user-defined functions in C (CAN-2005-0709)
Summary: CAN-2005-0710 MySQL security attacks via user-defined functions in C (CAN-200...
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: mysql   
(Show other bugs)
Version: 3.0
Hardware: All Linux
medium
medium
Target Milestone: ---
Assignee: Tom Lane
QA Contact: David Lawrence
URL:
Whiteboard:
Keywords: Security
: 151733 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-03-14 14:02 UTC by Bastien Nocera
Modified: 2013-07-03 03:04 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-03-28 19:44:49 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2005:334 normal SHIPPED_LIVE Important: mysql security update 2005-03-28 05:00:00 UTC

Description Bastien Nocera 2005-03-14 14:02:57 UTC
+++ This bug was initially created as a clone of Bug #150871 +++

Description of problem:
MySQL allows users with very low privileges to create user-defined
functions that reference code in loadable shared libraries.  Obviously
this creates a risk of users being able to cause the server to execute
arbitrary code.  There are some rather ad-hoc restrictions intended to
prevent misuse of the feature, but Stefano Di Paola found two
different ways to create problems anyway: you can call an arbitrary
function belonging to any standard system library, and you can
circumvent the check against giving an absolute path to a library.

Reported to vulnwatch.org by Stefano Di Paola on 11 Mar 2005

Version-Release number of selected component (if applicable):
mysql-server-3.23.58-2.3

How reproducible:
100%

Steps to Reproduce:
1.  See vulnwatch reports.

Additional info:
This is fixed in 4.1.10a, which we should upgrade to anyway as it
contains numerous other bug fixes.

My personal opinion is that adding more ad-hoc restrictions will never
make this feature secure, and that MySQL will ultimately have to do
something like what PostgreSQL does with their equivalent feature, ie
allow only database superusers to define functions written in C. 
We'll need to keep a close eye on this area.

Comment 1 Josh Bressers 2005-03-14 14:17:16 UTC
Tom,

I'm a bit confused.  Can you verify is this affects mysql 3.  I was under the
impression from your comments the other day that it does not.

Thanks

Comment 2 Tom Lane 2005-03-14 15:25:00 UTC
The notice from MySQL AB said that it affected 4.0.x and later; I assumed from
that that 3.x didn't have the issue, which may have been overoptimistic.  I'm
not sure that they are still supporting 3.x at all.

Comment 3 Tom Lane 2005-03-18 18:44:59 UTC
MySQL has now confirmed that the bugs also exist in 3.x, so we will need to do
something about a back-patch ... for both RHEL3 and AS2.1.

Comment 4 Tom Lane 2005-03-21 21:56:41 UTC
Back-patch created in mysql-3.23.58-15.RHEL3.1 for RHEL3 and
mysql-3.23.58-1.72.2 for AS2.1.

Comment 5 Josh Bressers 2005-03-28 18:52:41 UTC
*** Bug 151733 has been marked as a duplicate of this bug. ***

Comment 6 Josh Bressers 2005-03-28 19:44:49 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-334.html


Comment 8 foobarra 2005-03-30 13:35:30 UTC
The errata release is incomplete for RHEL-3, and does not include a patched
mysql-server package...

Comment 9 Mark J. Cox 2005-03-30 13:44:55 UTC
On RHEL3, mysql-server is part of "Extras", see bug 152437 for tracking.


Note You need to log in before you can comment on or make changes to this bug.