__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
MySQL Password Authentication Vulnerability
March 1, 2000 19:00 GMT Number K-025
______________________________________________________________________________
PROBLEM: A vulnerability has been identified in the MySQL database
server.
PLATFORM: MySQL database servers (versions prior to 3.22.32)
DAMAGE: Given a valid username, the normal password authentication
mechanism can be bypassed.
SOLUTION: Upgrade, install newer version, or apply workaround that is
listed below.
______________________________________________________________________________
VULNERABILITY Risk is medium. The attacker would have to have to know the
ASSESSMENT: username on the database.
______________________________________________________________________________
[ Start FreeBSD Advisory ]
=============================================================================
FreeBSD-SA-00:05 Security Advisory
FreeBSD, Inc.
Topic: MySQL allows bypassing of password authentication
Category: ports
Module: mysql322-server
Announced: 2000-02-28
Affects: Ports collection before the correction date.
Corrected: 2000-02-15
FreeBSD only: NO
I. Background
MySQL is a popular SQL database client/server distributed as part of the
FreeBSD ports collection.
II. Problem Description
The MySQL database server (versions prior to 3.22.32) has a flaw in the
password authentication mechanism which allows anyone who can connect to
the server to access databases without requiring a password, given a valid
username on the database - in other words, the normal password
authentication mechanism can be completely bypassed.
MySQL is not installed by default, nor is it "part of FreeBSD" as such: it
is part of the FreeBSD ports collection, which contains over 3100
third-party applications in a ready-to-install format.
FreeBSD makes no claim about the security of these third-party
applications, although an effort is underway to provide a security audit
of the most security-critical ports.
III. Impact
The successful attacker will have all of the access rights of that
database user and may be able to read, add or modify records.
If you have not chosen to install the mysql322-server port/package, then
your system is not vulnerable.
IV. Workaround
Use appropriate access-control lists to limit which hosts can initiate
connections to MySQL databases - see:
http://www.mysql.com/Manual_chapter/manual_Privilege_system.html
for more information. If unrestricted remote access to the database is not
required, consider using ipfw(8) or ipf(8), or your network perimeter
firewall, to prevent remote access to the database from untrusted machines
(MySQL uses TCP port 3306 for network communication). Note that users who
have access to machines which are allowed to initiate database connections
(e.g. local users) can still exploit the security hole.
V. Solution
One of the following:
1) Upgrade your entire ports collection and rebuild the mysql322-server
port.
2) Reinstall a new package obtained from:
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-
stable/databases/mysql-server-3.22.32.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-
current/databases/mysql-server-3.22.32.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-
current/databases/mysql-server-3.22.32.tgz
3) download a new port skeleton for the mysql322-server port from:
http://www.freebsd.org/ports/
and use it to rebuild the port.
4) Use the portcheckout utility to automate option (3) above. The
portcheckout port is available in /usr/ports/devel/portcheckout or the
package can be obtained from:
ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/devel/portcheckout-2.0.tgz
[ End FreeBSD Advisory ]
______________________________________________________________________________
CIAC wishes to acknowledge the contributions of FreeBSD, Inc. for the
information contained in this bulletin.
______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@llnl.gov
For emergencies and off-hour assistance, DOE, DOE contractor sites,
and the NIH may contact CIAC 24-hours a day. During off hours (5PM -
8AM PST), use one of the following methods to contact CIAC:
1. Call the CIAC voice number 925-422-8193 and leave a message, or
2. Call 888-449-8369 to send a Sky Page to the CIAC duty person or
3. Send e-mail to 4498369@skytel.com, or
4. Call 800-201-9288 for the CIAC Project Leader.
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
(or http://ciac.llnl.gov -- they're the same machine)
Anonymous FTP: ftp.ciac.org
(or ciac.llnl.gov -- they're the same machine)
Modem access: +1 (925) 423-4753 (28.8K baud)
+1 (925) 423-3331 (28.8K baud)
CIAC has several self-subscribing mailing lists for electronic
publications:
1. CIAC-BULLETIN for Advisories, highest priority - time critical
information and Bulletins, important computer security information;
2. SPI-ANNOUNCE for official news about Security Profile Inspector
(SPI) software updates, new features, distribution and
availability;
3. SPI-NOTES, for discussion of problems and solutions regarding the
use of SPI products.
Our mailing lists are managed by a public domain software package
called Majordomo, which ignores E-mail header subject lines. To
subscribe (add yourself) to one of our mailing lists, send the
following request as the E-mail message body, substituting
ciac-bulletin, spi-announce OR spi-notes for list-name:
E-mail to ciac-listproc@llnl.gov or majordomo@rumpole.llnl.gov:
subscribe list-name
e.g., subscribe ciac-bulletin
You will receive an acknowledgment E-mail immediately with a confirmation
that you will need to mail back to the addresses above, as per the
instructions in the E-mail. This is a partial protection to make sure
you are really the one who asked to be signed up for the list in question.
If you include the word 'help' in the body of an E-mail to the above address,
it will also send back an information file on how to subscribe/unsubscribe,
get past issues of CIAC bulletins via E-mail, etc.
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
K-015: ColdFusion Information Exposure (CFCACHE Tag)
K-016: Microsoft "Malformed IMAP Request" Vulnerability
K-017: Microsoft "Malformed RTF Control Word" Vulnerability
K-018: HP-UX - Security Vulnerability with PMTU Strategy
K-019: Microsoft - "Spoofed LPC Port Request" Vulnerability
K-020: Majordomo open() call Vulnerability
K-021: Malicious HTML Tags Vulnerability
K-022: FreeBSD - Asmon/Ascpu Vulnerability
K-023: FreeBSD - Delegate Proxy Server Vulnerability
K-024: Microsoft Systems Management Server Vulnerability
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH
