oss-security - Multiple SQL injections in MySQL/MariaDB

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 11 Sep 2012 15:03:24 +0200
From: sergii@...em.net
To: oss-security@...ts.openwall.com
Cc: security@...iadb.org
Subject: Multiple SQL injections in MySQL/MariaDB

Hi.

Recently, our developer Kristian Nielsen have discovered multiple SQL
injection like vulnerabilities in MySQL and MariaDB.
As of today, all versions of MySQL are affected.
Affected MariaDB versions are: 5.1.62 and below, 5.2.12 and below, 5.3.7 and
below, 5.5.25 and below. Latest MariaDB releases 5.3.8 and 5.5.27 have
this problem fixed.

The issue is numerous places in the code where SQL statements are
generated and written into the binary log. User-supplied identifiers
(table names, field names, etc.) are not always properly quoted (for
example, the proper quoted form of SPECI`AL is `SPECI``AL`), so
authorised users that have privileges to modify a table (any
non-temporary table) can inject arbitrary SQL into the binary log.

Such injected SQL will be executed by the slave or when a DBA does a
mysqlbinlog|mysql style point-in-time recovery.

During the normal MySQL replication (master-slave, not
mysqlbinlog|mysql), the options to exploit these vulnerabilities are
somewhat limited by the fact, that the slave does not execute many
statements, when it expects the one. So, one can not inject a new SQL
statement. But one can extend the WHERE condition, or modify tables that
he usually would have no access to.

Just to be clear: to exploit this one needs a valid account on the
server and privileges to modify data.

Regards,
Sergei Golubchik
MariaDB Security Coordinator

References:

1. MariaDB bug entry:

    https://mariadb.atlassian.net/browse/MDEV-382

2. MariaDB patches:

    http://bazaar.launchpad.net/~maria-captains/maria/5.1/revision/3151.1.1
    http://bazaar.launchpad.net/~maria-captains/maria/5.2/revision/3163.1.1
    http://bazaar.launchpad.net/~maria-captains/maria/5.3/revision/3556.1.2
    http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/3508

3. MySQL bug entry:

    http://bugs.mysql.com/66550

4. The CVE id for this vulnerability is CVE-2012-4414

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.