Red Hat Bugzilla – Bug 85971
possible root exploit in mysqld startup
Last modified: 2007-03-27 00:01:44 EDT
Description of problem:
Hi. I tried this on my own MySQL 3.23.55 !!!
I found out that logging as the root user, we can change mysqld to run as root
i.e. mysql but this works only if there's just one my.cnf file and it is locate
Here's how I did it...
Version-Release number of selected component (if applicable):
mysql < 3.23.56
Steps to Reproduce:
1. see URL for post above
Sergei Golubchik <email@example.com>
This issue has been adressed in 3.23.56 (release build is started
today), and some steps were taken to alleviate the threat.
listed under RH8.0
but also applies to all others
Assigning to myself. We'll have to wait until MySQL.com
releases the 3.23.56 packages. I may just upgrade to this
release when enabling thread safe clients.
This is CAN-2003-0150
Held this patch back while MySQL 3.23.56 was being spun. This fix will be
available via the errata system.