| 枫林在线论坛>>信息安全 [管理模式] [快速回复] [推荐给朋友] |
| [248187] 主题： MySQL Authentication Bypass (转载) |
| 作者： tshxp. |
标题：  MySQL Authentication Bypass (转载)[转载]
|
|
| 昵称： tshxp. |
来自： 202.194.*.* 
|
|
| 经验值： 0 | 发贴时间： 2004年07月07日 22:03:42 | |
| 等级： 新手上路 | 长度： 6689字 | |
|
发信人：tshxp@smth.org-SPAM.no (La Traviata)，信区：cn.bbs.comp.security 标 题：MySQL Authentication Bypass (转载) 发信站：BBS 水木清华站 转信站：FengLin!netnews.sdu.edu.cn!maily.cic.tsinghua.edu.cn!SMTH 【 以下文字转载自 BugTraqML 讨论区 】 发信人: nisr@nextgenss.com (NGSSoftware Insight Security Research), 信区: Bu gTraqML 标 题: MySQL Authentication Bypass 发信站: NCTU CSIE FreeBSD Server (Tue Jul 6 05:53:52 2004) 转信站: SMTH!maily.cic.tsinghua.edu.cn!whnet.dhs.org!netnews.sdu.edu.cn!news -ou 出 处: freebsd.csie.nctu.edu.tw NGSSoftware Insight Security Research Advisory Name: MySQL Authentication Bypass / Buffer Overflow Systems Affected: MySQL 4.1 prior to 4.1.3, and MySQL 5.0. Severity: High Vendor URL: http://www.mysql.com Author: Chris Anley [ chris@ngssoftware.com ] Date of Advisory: 1st July 2004 Whitepaper ********** We have written a paper that accompanies this advisory. The paper provides details of various MySQL lockdown techniques, and a review of common attacks on MySQL, including SQL injection. The paper can be found at http://www.ngssoftware.com/papers/HackproofingMySQL.pdf Description *********** "The MySQL database server is the world's most popular open source database." [www.mysql.com]. This advisory details a bug that allows a remote user to entirely bypass the MySQL password authentication mechanism, allowing them to authenticate as a MySQL user without knowing that user's password. Using a similar method, a stack buffer used in the authentication mechanism can be overflowed, though exploitation of the overflow is not straightforward. Details ******* MySQL 4.1 Authentication Bypass By submitting a carefully crafted authentication packet, it is possible for an attacker to bypass password authentication in MySQL 4.1. From check_connection (sql_parse.cpp), line ~837: /* Old clients send null-terminated string as password; new clients send the size (1 byte) + string (not null-terminated). Hence in case of empty password both send '\0'. */ uint passwd_len= thd->client_capabilities & CLIENT_SECURE_CONNECTIO N ? *passwd++ : strlen(passwd); Provided 0x8000 is specified in the client capabilities flags, the use can specify the passwd_len field of their choice. For this attack, we will choose 0x14 (20) which is the expected SHA1 hash length. Several checks are now carried out to ensure that the user is authenticating from a host that is permitted to connect. Provided these checks are passed, we reach: /* check password: it should be empty or valid */ if (passwd_len == acl_user_tmp->salt_len) { if (acl_user_tmp->salt_len == 0 || acl_user_tmp->salt_len == SCRAMBLE_LENGTH && check_scramble(passwd, thd->scramble, acl_user_tmp->salt ) == 0 || check_scramble_323(passwd, thd->scramble, (ulong *) acl_user_tmp->salt) == 0) { acl_user= acl_user_tmp; res= 0; } } the check_scramble function fails, but within the check_scramble_323 function we see: my_bool check_scramble_323(const char *scrambled, const char *message, ulong *hash_pass) { struct rand_struct rand_st; ulong hash_message[2]; char buff[16],*to,extra; /* Big enough for check */ const char *pos; hash_password(hash_message, message, SCRAMBLE_LENGTH_323); randominit(&rand_st,hash_pass[0] ^ hash_message[0], hash_pass[1] ^ hash_message[1]); to=buff; for (pos=scrambled ; *pos ; pos++) *to++=(char) (floor(my_rnd(&rand_st)*31)+64); extra=(char) (floor(my_rnd(&rand_st)*31)); to=buff; while (*scrambled) { if (*scrambled++ != (char) (*to++ ^ extra)) return 1; /* Wrong password */ } return 0; } At this point, the user has specified a 'scrambled' string that is as long as they wish. In the case of the straightforward authentication bypass, this is a zero-length string. The final loop compares each character in the 'scrambled' string against the string that mysql knows is the correct response, until there are no more characters in 'scrambled'. Since there are no characters *at all* in 'scrambled', the function returns '0' immediately, allowing the user to authenticate with a zero-length string. This bug is relatively easy to exploit, although it is necessary to write a custom MySQL client in order to do so. In addition to the zero-length string authentication bypass, the stack-based buffer 'buff' can be overflowed by a long 'scramble' string. The buffer is overflowed with characters output from my_rnd(), a pseudo random number generator. The characters are in the range 0x40..0x5f. On some platforms, arbitrary code execution is possible, though the exploit is complex and requires either brute force, or knowledge of at least one password hash. Fix Information and workarounds ******************************* MySQL AB were contacted on the 1st of June 2004 and the patch for this bug was present in the source code by the 2nd of June. Since MySQL prefer users to install via pre-built binary packages, NGS have delayed the release of this advisory until appropriate 'patch' packages were available. MySQL AB have fixed this bug in version 4.1.3, and the most recent builds of version 5.0. In addition to patching, various workarounds are possible for this bug. The attacker must know or be able to guess the name of a user in order for this attack to work, so renaming the default MySQL 'root' account is a reasonable precaution. Also, the account in question must be accessible from the attacker's host, so applying ip-address based login restrictions will also mitigate this bug. A check for this vulnerability has been added to Typhon III, NGSSoftware's advanced vulnerability assessment scanner. For more information please visit the NGSSoftware website at http://www.ngssoftware.com/ About NGSSoftware ***************** NGSSoftware design, research and develop intelligent, advanced application security assessment scanners. Based in the United Kingdom, NGSSoftware have offices in the South of London and the East Coast of Scotland. NGSSoftware's sister company NGSConsulting, offers best of breed security consulting services, specializing in application, host and network security assessments. http://www.ngssoftware.com/ Telephone +44 208 401 0070 Fax +44 208 401 0076 enquiries@ngssoftware.com |
|
|
========== * * * * * ==========
|
| 作者： IUSR. |
标题： Re: MySQL Authentication Bypass (转载)
|
|
| 昵称： IUSR. |
来自： 202.194.*.*
|
|
| 经验值： 0 | 发贴时间： 2004年07月07日 22:53:09 | |
| 等级： 新手上路 | 长度： 1051字 | |
|
|
发信人：IUSR.bbs@bbs.tju.edu.cn.no.spam (没有老婆，只能吃方便面…)，信区：cn .bbs.comp.security 标 题：Re: MySQL Authentication Bypass (转载) 发信站：天大求实BBS站 转信站：FengLin!netnews.sdu.edu.cn!news.happynet.org!news2.happynet.org!TJUB BS ft，sigh啊...限制登录主机吧... 【 在 tshxp@smth.org-SPAM.no (La Traviata) 的大作中提到: 】 : 【 以下文字转载自 BugTraqML 讨论区 】 : 发信人: nisr@nextgenss.com (NGSSoftware Insight Security Research), 信区: BugTraqML : 标 题: MySQL Authentication Bypass : 发信站: NCTU CSIE FreeBSD Server (Tue Jul 6 05:53:52 2004) : 转信站: SMTH!maily.cic.tsinghua.edu.cn!whnet.dhs.org!netnews.sdu.edu.cn!ne ws-ou : 出 处: freebsd.csie.nctu.edu.tw : NGSSoftware Insight Security Research Advisory : Name: MySQL Authentication Bypass / Buffer Overflow : Systems Affected: MySQL 4.1 prior to 4.1.3, and MySQL 5.0. : ................... -- 时无英雄，使竖子成名。 古来圣贤皆寂寞，唯有饮者留其名。 －－怪不得我无名又寂寞（表想歪） ※ 来源:．天大求实BBS bbs.tju.edu.cn．[FROM: 202.113.13.188] |
|
|
========== * * * * * ==========
|
| 作者： asker. |
标题： Re: MySQL Authentication Bypass (转载)
|
|
| 昵称： asker. |
来自： 202.194.*.*
|
|
| 经验值： 0 | 发贴时间： 2004年07月08日 00:46:51 | |
| 等级： 新手上路 | 长度： 547字 | |
|
|
发信人：asker@smth.org-SPAM.no (Jeffrey)，信区：cn.bbs.comp.security 标 题：Re: MySQL Authentication Bypass (转载) 发信站：BBS 水木清华站 转信站：FengLin!netnews.sdu.edu.cn!maily.cic.tsinghua.edu.cn!SMTH 大bug 跟win98漏洞差不多？ 【 在 tshxp (La Traviata) 的大作中提到: 】 : 【 以下文字转载自 BugTraqML 讨论区 】 : 发信人: nisr@nextgenss.com (NGSSoftware Insight Security Research), 信区: BugTraqML : 标 题: MySQL Authentication Bypass : ................... -- ※ 来源:·BBS 水木清华站 smth.org·[FROM: 210.77.10.*] |
|
|
========== * * * * * ==========
|
| 作者： little |
标题：  Re: MySQL Authentication Bypass (转载)
|
|
| 昵称： 渺小 |
来自： 192.168.*.*
|
|
| 经验值： 9125 | 发贴时间： 2004年07月09日 02:39:42 | |
| 等级： 精于此道 | 长度： 1012字 | |
|
下载最新的代码，重新编译安装了。
【 在 (IUSR.) 的大作中提到: 】 : 发信人：IUSR.bbs@bbs.tju.edu.cn.no.spam (没有老婆，只能吃方便面…) : ，信区：cn.bbs.comp.security : 标 题：Re: MySQL Authentication Bypass (转载) : 发信站：天大求实BBS站 : 转信站：FengLin!netnews.sdu.edu.cn!news.happynet.org!news2.happynet.org!T : JUBBS : : ft，sigh啊...限制登录主机吧... : 【 在 tshxp@smth.org-SPAM.no (La Traviata) 的大作中提到: 】 : : 【 以下文字转载自 BugTraqML 讨论区 】 : : 发信人: nisr@nextgenss.com (NGSSoftware Insight Security Research), 信区 : : BugTraqML : : 标 题: MySQL Authentication Bypass : : 发信站: NCTU CSIE FreeBSD Server (Tue Jul 6 05:53:52 2004) : : 转信站: SMTH!maily.cic.tsinghua.edu.cn!whnet.dhs.org!netnews.sdu.edu.cn : !news-ou : : 出 处: freebsd.csie.nctu.edu.tw : : NGSSoftware Insight Security Research Advisory : : Name: MySQL Authentication Bypass / Buffer Overflow : : Systems Affected: MySQL 4.1 prior to 4.1.3, and MySQL 5.0. : : ................... : : |
|
|
========== * * * * * ==========
|
 Top
|
||