bugtraq - Re: MySQL 5.0 information leak?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060121003057.GK6026@ns.snowman.net>
Date: Fri, 20 Jan 2006 19:30:57 -0500
From: Stephen Frost <sfrost@...wman.net>
To: Bernd Wurst <bernd@...rst.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: MySQL 5.0 information leak?

* Bernd Wurst (bernd@...rst.org) wrote:
> I think of this as a security issue because I have user accounts (nss) 
> that have publicly available credentials but noone should be able to 
> see how the database really is organized. 
> 
> What do you think of this? Bug?

Probably not but the answer you seek is in the SQL specification.
Information Schema is defined there and it also defines what is allowed
to be seen and by whom.  Wanting to hide the database layout from the
users of the database in this way seems quite... confused.

	Thanks,

		Stephen

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)