Date: Thu, 18 Nov 2010 08:39:47 -0500 (EST) From: Josh Bressers <bressers@...hat.com> To: oss-security@...ts.openwall.com Cc: coley <coley@...re.org> Subject: Re: Clear text password in process list when using MySQL GUI tools ----- "Martin Drescher" <drescher@...fu.de> wrote: > > If you use some MySQL-GUI-tool in most (any?) linux distribution like > mysql-admin or mysql-query-browser and then open 'Tools -> MySQL Text > Console' your password, user name and host will become exposed in the > process list. > > I think this issue must exists over a long time in many distributions > now but nobody ever cared about. > > For Debian users: > Packages mysql-query-browser, mysql-admin are affected. > While I suspect there are more things with these problems, let's start with these two: CVE-2010-4177 mysql-query-browser clear text password in process list CVE-2010-4178 mysql-admin clear text password in process list Thanks. -- JB
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.