MySQL Bugs: #10964: Information Schema:Authorization check on privilege tables is improper

Bug #10964	Information Schema:Authorization check on privilege tables is improper
Submitted:	30 May 2005 16:46	Modified:	24 Jun 2005 5:07
Reporter:	Disha
Status:	Closed
Category:	Server	Severity:	S2 (Serious)
Version:	5.0.5-Beta	OS:	Microsoft Windows (Windows Server 2003)
Assigned to:	Sergey Gluhov	Target Version:

Description:
The authorization checks on information_schema privilege tables is improper i.e. any user
with limited privileges can query the information_schema tables to get the details about
privileges granted to different users on different database objects even when he does not
have any permission on those objects. The tables are:
1. USER_PRIVILEGES Table 
2. SCHEMA_PRIVILEGES Table 
3. TABLE_PRIVILEGES Table 
4. COLUMN_PRIVILEGES Table 

How to repeat:
1. create user user1//
2. create user user2//
3. create database db1//
4. use db1//
5. create table t1 (f1 int, f2 int)//
6. create database db2//
7. use db2//
8. create table t2 (f1 int)//
9. grant select on db1.t1(f1) to user1//
10. grant select on db2.t2 to user2//
11. Connect to mysql server as user1.
12. select * from information_schema.column_privileges//
13. select * from information_schema.table_privileges//

Expected Result: The result set returned in Step 12 should have the details for user1
listed and that returned in Step 13 should be empty.

Actual Result: The result set returned in Step 12 returns the details for user1 and that
returned in Step 13 lists the details for user2.

Thanks for your bug report.

I tested this in 5.0.7 from bk.

There where the results that I got when executing steps 12 & 13:

mysql> delimiter //
mysql> select * from information_schema.column_privileges//
Empty set (0.00 sec)

mysql> select * from information_schema.table_privileges//
+-------------+---------------+--------------+------------+----------------+--------------
+
| GRANTEE     | TABLE_CATALOG | TABLE_SCHEMA | TABLE_NAME | PRIVILEGE_TYPE | IS_GRANTABLE
|
+-------------+---------------+--------------+------------+----------------+--------------
+
| 'user1'@'%' | NULL          | db1          | t1         | SELECT         | NO          
|
| 'user2'@'%' | NULL          | db2          | t2         | SELECT         | NO          
|
+-------------+---------------+--------------+------------+----------------+--------------
+
2 rows in set (0.00 sec)

mysql>

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/internals/25446

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/internals/25506

Fixed in 5.0.7

Thank you for your bug report. This issue has been committed to our
source repository of that product and will be incorporated into the
next release.

If necessary, you can access the source repository and build the latest
available version, including the bugfix, yourself. More information 
about accessing the source trees is available at
    http://www.mysql.com/doc/en/Installing_source_tree.html

Additional info:

Documented fix in 5.0.7 changelog; bug closed.