MySQL Bugs: #35955: Regression: I_S table cause reduced privilege requirements in SELECT.

Bug #35955	Regression: I_S table cause reduced privilege requirements in SELECT.
Submitted:	10 Apr 2008 7:49	Modified:	21 Apr 2008 18:27
Reporter:	Kristofer Pettersson	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Security: Privileges	Severity:	S3 (Non-critical)
Version:	6.0	OS:	Any
Assigned to:	Kristofer Pettersson	CPU Architecture:	Any

Description:
This bug was caused by refactoring to resolve issues related to bug#27145.

In check_table_access:
...
    if (tables->schema_table)
    {
      want_access &= ~SELECT_ACL;
...

The requirements are degraded as the function are iterating over TABLE_LIST objects.

How to repeat:
create database testdb1;
use testdb1;
create table t1 (c1 int);
create table t2 (c2 int);
grant select on testdb1.t1 to mysqluser1@localhost;

--connect (mysqluser1, localhost, mysqluser1, , testdb1)
--error 1142
select * from t2;
--error 1142
select * from t2, information_schema.tables;
select * from information_schema.tables, t2;

Suggested fix:
Reset the requirement want_access to original value in the beginning of each iteration.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/45173

ChangeSet@1.2628, 2008-04-10 10:54:17+02:00, thek@adventure.(none) +5 -0
  Bug#35955 Regression: I_S table cause reduced privilege requirements in SELECT.
  
  The privilege requirements were reduced if a table list contained at least
  one information schema table.
   
  The fix is to reset the privilege requirements in check_table_access 
  for each iteration over a TABLE_LIST object.

Pushed into 6.0.6-alpha

Noted in 6.0.6 changelog.

If a SELECT table list contained at least one INFORMATION_SCHEMA
table, the required privileges for accessing the other tables were
reduced.