bugtraq - [AppSecInc Advisory MYSQL05-V0001] Improper Filtering of Directory Traversal Characters in MySQL User Defined Functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <42F7DFF6.7040408@appsecinc.com>
Date: Mon, 08 Aug 2005 18:43:02 -0400
From: Team SHATTER <shatter@...secinc.com>
To: bugtraq@...urityfocus.com
Cc: full-disclosure@...ts.grok.org.uk, vulnwatch@...nwatch.org,
	bugs@...uritytracker.com, security@...ts.seifried.org
Subject: [AppSecInc Advisory MYSQL05-V0001] Improper
 Filtering of Directory
 Traversal Characters in MySQL User Defined Functions

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Improper Filtering of Directory Traversal Characters in MySQL User
Defined Functions

AppSecInc Team SHATTER Security Advisory MYSQL05-V0001
http://www.appsecinc.com/resources/alerts/mysql/2005-001.html
August 08, 2005

Risk level: LOW

Credits: This vulnerability was discovered and researched by Reid
Borsuk of Application Security Inc.

Affected Versions:
ALL

Background:
User-defined functions in MySQL allow a user in the database to call
binary libraries on the operating system. Creating a user-defined
function requires insert privileges on the mysql.func table.

Details:
The UDF creation functions attempt to filter out directory traversal
characters, restricting access to libraries only in system and MySQL
directories.

The problem exists in the fact that MySQL only uses the forward slash
(/) as a path separator. Windows machines use the backslash (\)
character to separate directories in paths. This allows an attacker to
bypass directory traversal checks and include arbitrary files.

This may allow an attacker to execute arbitrary code if they are able
to drop a file either through FILE privileges, or other attacks on
MySQL or other programs.

It should be noted that this is a Windows specific issue; other
operating systems are not likely to be affected.

Exploiting this vulnerability would require the ability to create
user-defined functions. This is not typically granted to untrusted
users, however given this vulnerability you should understand the
ramifications of granting the ability to create user-defined functions.

Workaround:
Restrict access to create user-defined functions.

Vendor Status:
Vendor was contacted and a patch was released.

Fix:
MySQL versions 4.0.25, 4.1.13, or 5.0.7-beta have been patched. These
products can be found here:
http://dev.mysql.com/downloads/

Links:
Application Security, Inc advisory:
http://www.appsecinc.com/resources/alerts/mysql/2005-001.html

- --
_____________________________________________
Application Security, Inc.
www.appsecinc.com
AppSecInc is the leading provider of database security solutions for
the enterprise. AppSecInc products proactively secure enterprise
applications at more than 300 organizations around the world by
discovering, assessing, and protecting the database against rapidly
changing security threats. By securing data at its source, we enable
organizations to more confidently extend their business with
customers, partners and suppliers. Our security experts, combined with
our strong support team, deliver up-to-date application safeguards
that minimize risk and eliminate its impact on business.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)

iD8DBQFC99/2/0w1dSVRt4URAmVxAJ9M2r5gJ/uKLWYIY9NcntejOxgC2wCghTRl
fuwiXpRItP5qp72kIWKH3vY=
=vBK4
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/