+++ This bug was initially created as a clone of Bug #150871 +++ Description of problem: MySQL allows users with very low privileges to create user-defined functions that reference code in loadable shared libraries. Obviously this creates a risk of users being able to cause the server to execute arbitrary code. There are some rather ad-hoc restrictions intended to prevent misuse of the feature, but Stefano Di Paola found two different ways to create problems anyway: you can call an arbitrary function belonging to any standard system library, and you can circumvent the check against giving an absolute path to a library. Reported to vulnwatch.org by Stefano Di Paola on 11 Mar 2005 Version-Release number of selected component (if applicable): mysql-server-3.23.58-2.3 How reproducible: 100% Steps to Reproduce: 1. See vulnwatch reports. Additional info: This is fixed in 4.1.10a, which we should upgrade to anyway as it contains numerous other bug fixes. My personal opinion is that adding more ad-hoc restrictions will never make this feature secure, and that MySQL will ultimately have to do something like what PostgreSQL does with their equivalent feature, ie allow only database superusers to define functions written in C. We'll need to keep a close eye on this area.
Tom, I'm a bit confused. Can you verify is this affects mysql 3. I was under the impression from your comments the other day that it does not. Thanks
The notice from MySQL AB said that it affected 4.0.x and later; I assumed from that that 3.x didn't have the issue, which may have been overoptimistic. I'm not sure that they are still supporting 3.x at all.
MySQL has now confirmed that the bugs also exist in 3.x, so we will need to do something about a back-patch ... for both RHEL3 and AS2.1.
Back-patch created in mysql-3.23.58-15.RHEL3.1 for RHEL3 and mysql-3.23.58-1.72.2 for AS2.1.
*** Bug 151733 has been marked as a duplicate of this bug. ***
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-334.html
The errata release is incomplete for RHEL-3, and does not include a patched mysql-server package...
On RHEL3, mysql-server is part of "Extras", see bug 152437 for tracking.