Date: Tue, 11 Sep 2012 15:03:24 +0200 From: sergii@...em.net To: oss-security@...ts.openwall.com Cc: security@...iadb.org Subject: Multiple SQL injections in MySQL/MariaDB Hi. Recently, our developer Kristian Nielsen have discovered multiple SQL injection like vulnerabilities in MySQL and MariaDB. As of today, all versions of MySQL are affected. Affected MariaDB versions are: 5.1.62 and below, 5.2.12 and below, 5.3.7 and below, 5.5.25 and below. Latest MariaDB releases 5.3.8 and 5.5.27 have this problem fixed. The issue is numerous places in the code where SQL statements are generated and written into the binary log. User-supplied identifiers (table names, field names, etc.) are not always properly quoted (for example, the proper quoted form of SPECI`AL is `SPECI``AL`), so authorised users that have privileges to modify a table (any non-temporary table) can inject arbitrary SQL into the binary log. Such injected SQL will be executed by the slave or when a DBA does a mysqlbinlog|mysql style point-in-time recovery. During the normal MySQL replication (master-slave, not mysqlbinlog|mysql), the options to exploit these vulnerabilities are somewhat limited by the fact, that the slave does not execute many statements, when it expects the one. So, one can not inject a new SQL statement. But one can extend the WHERE condition, or modify tables that he usually would have no access to. Just to be clear: to exploit this one needs a valid account on the server and privileges to modify data. Regards, Sergei Golubchik MariaDB Security Coordinator References: 1. MariaDB bug entry: https://mariadb.atlassian.net/browse/MDEV-382 2. MariaDB patches: http://bazaar.launchpad.net/~maria-captains/maria/5.1/revision/3151.1.1 http://bazaar.launchpad.net/~maria-captains/maria/5.2/revision/3163.1.1 http://bazaar.launchpad.net/~maria-captains/maria/5.3/revision/3556.1.2 http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/3508 3. MySQL bug entry: http://bugs.mysql.com/66550 4. The CVE id for this vulnerability is CVE-2012-4414
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.