oss-sec mailing list archives
Re: CVE-2020-7221: mariadb: possible local mysql to root user exploit in mysql_install_db script setting permissions of /usr/lib64/mysql/plugin/auth_pam_tool_dir/auth_pam_tool
From: Matthias Gerstner <mgerstner () suse de>
Date: Tue, 4 Feb 2020 14:09:19 +0100
Hi, On Tue, Feb 04, 2020 at 01:27:11PM +0100, Solar Designer wrote:
I personally suggest the following directory mode instead: root:mysql 0750 /usr/lib/mysql/plugin/auth_pam_tool_dirWhy not simply root:mysql 04710 /usr/lib/mysql/plugin/auth_pam_tool without the directory? I see only one reason: it's a bigger change relative to the current implementation, which is more work now, but perhaps this cleanup is worth it longer-term.
yes, exactly. I don't want to diverge too much from what upstream does at the moment. When this doesn't matter then your suggestion is the better one and would be the cleaner approach for upstream to follow. Cheers Matthias
Attachment:
signature.asc
Description:
Current thread:
- CVE-2020-7221: mariadb: possible local mysql to root user exploit in mysql_install_db script setting permissions of /usr/lib64/mysql/plugin/auth_pam_tool_dir/auth_pam_tool Matthias Gerstner (Feb 04)
- Re: CVE-2020-7221: mariadb: possible local mysql to root user exploit in mysql_install_db script setting permissions of /usr/lib64/mysql/plugin/auth_pam_tool_dir/auth_pam_tool Solar Designer (Feb 04)
- Re: CVE-2020-7221: mariadb: possible local mysql to root user exploit in mysql_install_db script setting permissions of /usr/lib64/mysql/plugin/auth_pam_tool_dir/auth_pam_tool Matthias Gerstner (Feb 04)
- Re: CVE-2020-7221: mariadb: possible local mysql to root user exploit in mysql_install_db script setting permissions of /usr/lib64/mysql/plugin/auth_pam_tool_dir/auth_pam_tool Solar Designer (Feb 04)