-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Improper Filtering of Directory Traversal Characters in MySQL User Defined Functions AppSecInc Team SHATTER Security Advisory MYSQL05-V0001 http://www.appsecinc.com/resources/alerts/mysql/2005-001.html August 08, 2005 Risk level: LOW Credits: This vulnerability was discovered and researched by Reid Borsuk of Application Security Inc. Affected Versions: ALL Background: User-defined functions in MySQL allow a user in the database to call binary libraries on the operating system. Creating a user-defined function requires insert privileges on the mysql.func table. Details: The UDF creation functions attempt to filter out directory traversal characters, restricting access to libraries only in system and MySQL directories. The problem exists in the fact that MySQL only uses the forward slash (/) as a path separator. Windows machines use the backslash (\) character to separate directories in paths. This allows an attacker to bypass directory traversal checks and include arbitrary files. This may allow an attacker to execute arbitrary code if they are able to drop a file either through FILE privileges, or other attacks on MySQL or other programs. It should be noted that this is a Windows specific issue; other operating systems are not likely to be affected. Exploiting this vulnerability would require the ability to create user-defined functions. This is not typically granted to untrusted users, however given this vulnerability you should understand the ramifications of granting the ability to create user-defined functions. Workaround: Restrict access to create user-defined functions. Vendor Status: Vendor was contacted and a patch was released. Fix: MySQL versions 4.0.25, 4.1.13, or 5.0.7-beta have been patched. These products can be found here: http://dev.mysql.com/downloads/ Links: Application Security, Inc advisory: http://www.appsecinc.com/resources/alerts/mysql/2005-001.html - -- _____________________________________________ Application Security, Inc. www.appsecinc.com AppSecInc is the leading provider of database security solutions for the enterprise. AppSecInc products proactively secure enterprise applications at more than 300 organizations around the world by discovering, assessing, and protecting the database against rapidly changing security threats. By securing data at its source, we enable organizations to more confidently extend their business with customers, partners and suppliers. Our security experts, combined with our strong support team, deliver up-to-date application safeguards that minimize risk and eliminate its impact on business. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (MingW32) iD8DBQFC99/2/0w1dSVRt4URAmVxAJ9M2r5gJ/uKLWYIY9NcntejOxgC2wCghTRl fuwiXpRItP5qp72kIWKH3vY= =vBK4 -----END PGP SIGNATURE-----
This archive was generated by hypermail 2.1.3 : Mon Aug 08 2005 - 20:00:29 PDT