[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 18 Feb 2014 13:36:33 +0100
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE Request: Percona Toolkit automatic version check - remote code
execution / information leak
Hi,
https://bugs.launchpad.net/percona-toolkit/+bug/1279502
https://bugzilla.novell.com/show_bug.cgi?id=864194
Quoting launchpad we have this gem:
-------------------------------------------------------------------------------
Percona Toolkit 2.1 introduced --version-check to warn user about
known vulnerabilities in the local MySQL instance and to check for PT
updates. When this option is enabled - and it is enabled by default(!) -
various information about local MySQL as well as other system binaries and
packages are submitted to Percona along with the server's IP address. This
not only exposes possibly sensitive information, but also does so without
bringing it to user's attention or asking for their consent.
It gets worse. The configuration for what information PT tools should
collect is not hardcoded in the scripts. Instead, every time it's
downloaded from http://v.percona.com/. One of the possible parameters
is a binary file name to be executed, i.e. Percona can remotely execute
arbitrary command - again, without making user aware of what or when
is being executed. To be fair, the ability to run commands is limited
to running "command -v", however that's only under the assumption that
the command filters will always work. The configuration can also ask
for any MySQL variable - not just the version string.
In my opinion --version-check should never be enabled by default and
if user wants to keep it enabled, the configuration (i.e. the list of
checks) should be hardcoded and explicitly listed, and not downloaded
from a remote location.
Current workaround: To avoid confidential information being exposed,
always use --no-version-check with every PT tool that includes
'version-check' feature (e.g. pt-query-digest, pt-diskstats).
-------------------------------------------------------------------------------
Basically it is not just information leakage, but remote code execution if
you can overtake the v.percona.com host or just be man in the middle.
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
