Important Security Fix for a Buffer Overflow Bug: MariaDB 5.5.28a, 5.3.11, 5.2.13 and 5.1.66 include a fix for CVE-2012-5579, a vulnerability that allowed an authenticated user to crash MariaDB server or to execute arbitrary code with the privileges of the mysqld process. This is a serious security issue. We recommend upgrading from older versions as soon as possible.
MariaDB 5.5.28a, 5.3.11, 5.2.13 and 5.1.66 (GA) binaries, packages, and source tarballs are now available for download from http://downloads.mariadb.org. So you can upgrade within your own major series.
Note that while this fix has just been published, some other vulnerabilities have been noted over the weekend also. Below a summary of these other CVEs as documented by Red Hat Security Response Team, with annotations by Sergei Gulubchik who is the Security Coordinator for[Read more...]
* CVE-2012-5611 MySQL (Linux) Stack based buffer overrun PoC Zeroday[Read more...]
* CVE-2012-5612 MySQL (Linux) Heap Based Overrun PoC Zeroday
* CVE-2012-5613 MySQL (Linux) Database Privilege Elevation Zeroday
common_schema 1.2 is released! This version comes shortly after 1.1, yet contains quite a few interesting goodies:
A closer look at these follows:
A new view called[Read more...]
I previously published stored programs to help implement a (more) comprehensive password policy in MySQL 5.6, building on the password complexity plugin now available in MySQL 5.6. This proof-of-concept has been expanded recently, and the updated package is available here. There’s a few notable changes to the earlier version:
The mysql database is meant for system tables, and I try to keep everything not directly managed by the MySQL server out of that database. The initial proof-of-concept implementation violated this principal – the[Read more...]
I’ve been looking at the new ALTER USER … PASSWORD EXPIRE command as I try to implement a comprehensive password policy for MySQL 5.6. There’s a few aspects of this feature that I found interesting, and thought others might benefit from what I’ve learned. Here’s a quick summary:
This is important because there’s no other way to dynamically bind ALTER USER statements to a user name and host, which is necessary if you are trying to automate anything related to password policies. This wasn’t the case with earlier 5.6 releases, but was fixed in 5.6.8-rc:
mysql> SELECT password_expired -> FROM mysql.user -> WHERE user = 'root' AND host = 'localhost'; +------------------+ | password_expired |[Read more...]
I’ve been working on revising my password policy scripts, and in the process, thought about the privileges required. My first draft added tables to the
mysql system database and leveraged the
root@localhost account. I’m looking to lock that down for the next iteration. It’s easy to move the tables and procedures out of the
mysql system database into a new
password_policy database, but what to do about the use of the root account?
Ideally we would use an account that has the minimum privileges necessary to successfully execute the stored procedures. But these aren’t trivial permissions:
In a previous post, I noted that the new new password verification plugin in MySQL 5.6 provides a basis for implementing a more comprehensive password policy. Most notably, password policies include requirements around password strength, duration, and reuse. While the password validation plugin focuses on password strength policy components, there are ways to roll your own processes in support of password expiration and reuse policy components. Unlike the password verification plugin, the tools I will describe below don’t hook directly into account maintenance commands.
You can download the full .SQL file (in a .ZIP package)[Read more...]
Managing Multiple MySQL Servers From One phpMyAdmin Installation (Using SSL Encryption)
This tutorial explains how you can manage multiple MySQL servers from one phpMyAdmin installation. For security reasons, communication between phpMyAdmin and any remote MySQL server is using SSL encryption (this is not necessary for a local MySQL server since communication between phpMyAdmin and MySQL is not leaving the server). phpMyAdmin is a free software tool written in PHP, intended to handle the administration of MySQL over the World Wide Web. phpMyAdmin supports a wide range of operations with MySQL.