oss-sec mailing list archives
Multiple SQL injections in MySQL/MariaDB
From: sergii () pisem net
Date: Tue, 11 Sep 2012 15:03:24 +0200
Hi. Recently, our developer Kristian Nielsen have discovered multiple SQL injection like vulnerabilities in MySQL and MariaDB. As of today, all versions of MySQL are affected. Affected MariaDB versions are: 5.1.62 and below, 5.2.12 and below, 5.3.7 and below, 5.5.25 and below. Latest MariaDB releases 5.3.8 and 5.5.27 have this problem fixed. The issue is numerous places in the code where SQL statements are generated and written into the binary log. User-supplied identifiers (table names, field names, etc.) are not always properly quoted (for example, the proper quoted form of SPECI`AL is `SPECI``AL`), so authorised users that have privileges to modify a table (any non-temporary table) can inject arbitrary SQL into the binary log. Such injected SQL will be executed by the slave or when a DBA does a mysqlbinlog|mysql style point-in-time recovery. During the normal MySQL replication (master-slave, not mysqlbinlog|mysql), the options to exploit these vulnerabilities are somewhat limited by the fact, that the slave does not execute many statements, when it expects the one. So, one can not inject a new SQL statement. But one can extend the WHERE condition, or modify tables that he usually would have no access to. Just to be clear: to exploit this one needs a valid account on the server and privileges to modify data. Regards, Sergei Golubchik MariaDB Security Coordinator References: 1. MariaDB bug entry: https://mariadb.atlassian.net/browse/MDEV-382 2. MariaDB patches: http://bazaar.launchpad.net/~maria-captains/maria/5.1/revision/3151.1.1 http://bazaar.launchpad.net/~maria-captains/maria/5.2/revision/3163.1.1 http://bazaar.launchpad.net/~maria-captains/maria/5.3/revision/3556.1.2 http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/3508 3. MySQL bug entry: http://bugs.mysql.com/66550 4. The CVE id for this vulnerability is CVE-2012-4414
Current thread:
- Multiple SQL injections in MySQL/MariaDB sergii (Sep 11)