Hello...
On Sat, 2003-03-08 at 03:58, [EMAIL PROTECTED] wrote:
> Hi. I tried this on my own MySQL 3.23.55 !!!
> I found out that logging as the root user, we can change mysqld to run as root
> instead that i.e. mysql but this works only if there's just one my.cnf file and it
> is locate in /etc...
> Here's how I did it...
>
> I logged in as root and than I did this:
>
> mysql>CREATE DATABASE roottext;
> mysql>USE roottext;
> mysql>CREATE TABLE hack (conf VARCHAR(80));
> mysql>INSERT IN hack VALUES ('[mysqld]');
> mysql>INSERT IN hack VALUES ('user=root');
> mysql>SELECT * INTO OUTFILE '/path/to/mysql/datadir/my.cnf' FROM hack
> mysql>QUIT
>
> Doing so we have create a my.cnf in mysql datadir containing:
>
> [mysqld]
> user=root
>
> Now, when the mysql server will be restarted, the user option in our datadit my.cnf
> will override the one in /etc/my.cnf and mysql server will run as root, with all the
> security flwas that it takes...
> This is very dangerous if we think that in mysql <= 3.23.53 it is really easy to get
> root access due to a bug (an exploit has been released publicly)...
> I dunno how this problem can be solved, I'd like to hear from you something...
Quick fix:
change ownership of ~mysql/my.cnf to (system) root
chattr +i
e.g.:
[EMAIL PROTECTED] /var/lib/mysql]$ sudo vi my.cnf
[EMAIL PROTECTED] /var/lib/mysql]$ cat my.cnf
# Empty
[EMAIL PROTECTED] /var/lib/mysql]$ sudo chattr +i my.cnf
[EMAIL PROTECTED] /var/lib/mysql]$ sudo -u mysql perl -pi -e "s#Empty# Mine#"
my.cnf
Can't remove my.cnf: Operation not permitted, skipping file.
[EMAIL PROTECTED] /var/lib/mysql]$ cat my.cnf
# Empty
[EMAIL PROTECTED] /var/lib/mysql]$ ls -la
total 28
drwxr-xr-x 3 mysql mysql 4096 Mar 9 17:43 .
drwxr-xr-x 18 root root 4096 Nov 16 18:24 ..
-rw-r--r-- 1 root root 8 Mar 9 17:42 my.cnf
> Thanks.... :)
> by
> Gufino
--
Christopher McCrory
"The guy that keeps the servers running"
[EMAIL PROTECTED]
http://www.pricegrabber.com
Let's face it, there's no Hollow Earth, no robots, and
no 'mute rays.' And even if there were, waxed paper is
no defense. I tried it. Only tinfoil works.
