lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <00d701c61e30$c7086f00$f400ca0a@burtonstrauss.local>
Date: Fri, 20 Jan 2006 20:17:03 -0600
From: "Burton Strauss" <Security@...llNetSolutions.com>
To: "'Bernd Wurst'" <bernd@...rst.org>, <bugtraq@...urityfocus.com>
Subject: RE: MySQL 5.0 information leak?


Traditionally the schema for a database is NOT secure information.
Applications download this information to build queries on the fly.

The essential problem is relying on security by obscurity, "I have user
accounts (nss) that have publicly available credentials but noone [sic]
should be able to see how the database really is organized".

-----Burton 

-----Original Message-----
From: Bernd Wurst [mailto:bernd@...rst.org] 
Sent: Friday, January 20, 2006 6:05 AM
To: bugtraq@...urityfocus.com
Subject: MySQL 5.0 information leak?

Hi.

I just upgraded to mysql 5.0.18 and started using all those cool new
features. :)

But concerning VIEWs, I think the information_schema is too verbose to the
user. I started creating a VIEW that searches information from several
tables, mangles the data and gives the user a clean table with his data. So
far, so good.

But I only give the user access to this VIEW, so he cannot see what's done
to get his data from several tables.

SHOW CREATE VIEW myview;
does (correctly) result in an error that the user is not allowed to see the
CREATE VIEW.

But SELECT * FROM information_schema.views; returns the full query that
ceates the desired VIEW.

I think of this as a security issue because I have user accounts (nss) that
have publicly available credentials but noone should be able to see how the
database really is organized. 

What do you think of this? Bug?

cu, Bernd

--
Windows Error 019: User error. It's not our fault. Is not! Is not!



Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ