full-disclosure - User bypass privs for Mysql??

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200405181004.53441.james.bliss@comcast.net>
From: james.bliss at comcast.net (James Bliss)
Subject: User bypass privs for Mysql??

What were your other privileges.  If you did not have any grants then why 
in the heck did you have any access rights to the mysql database (not 
product) tables?  Seems that you had a DBA error, not a product error.

Jim

On Tuesday 18 May 2004 9:02 am, Esler, Joel - Contractor wrote:
> Not having any grant permissions.  I went into the mysql/user table and
> edited the Grant from N to Y.  Logged out and logged back in, and I had
> full privs including Grant.  I shouldn't be able to do this...
>
> Joel
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html