| Bug #59453 | Non-ASCIIZ string kills protocol extensibility in MySQL 5.5 | ||
|---|---|---|---|
| Submitted: | 12 Jan 2011 17:38 | Modified: | 29 Jan 2011 23:19 |
| Reporter: | Andrey Hristov | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server: Security: Privileges | Severity: | S2 (Serious) |
| Version: | 5.5.x | OS: | Any |
| Assigned to: | Georgi Kodinov | CPU Architecture: | Any |
[12 Jan 2011 17:40]
Andrey Hristov
Full excerpt:
if (mysql->server_capabilities & CLIENT_PLUGIN_AUTH)
{
scramble_data_len= pkt_scramble_len;
scramble_plugin= scramble_data + scramble_data_len;
if (scramble_data + scramble_data_len > pkt_end)
scramble_data_len= pkt_end - scramble_data;
}
[14 Jan 2011 15:50]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/128817 3247 Georgi Kodinov 2011-01-14 Bug #59453: Non-ASCIIZ string kills protocol extensibility in MySQL 5.5 When the server sends the name of the plugin it's using in the handshake packet it was null terminating it in it's buffer, but was sending a length of the packet 1 byte short. Fixed to send the terminating 0 as well by increasing the length of the packet to include it. In this way the handshake packet becomes similar to the change user packet where the plugin name is null terminated. No test suite added as the fix can only be observed by analyzing the bytes sent over the wire.
[24 Jan 2011 14:52]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/129448 3272 Georgi Kodinov 2011-01-14 Bug #59453: Non-ASCIIZ string kills protocol extensibility in MySQL 5.5 When the server sends the name of the plugin it's using in the handshake packet it was null terminating it in it's buffer, but was sending a length of the packet 1 byte short. Fixed to send the terminating 0 as well by increasing the length of the packet to include it. In this way the handshake packet becomes similar to the change user packet where the plugin name is null terminated. No test suite added as the fix can only be observed by analyzing the bytes sent over the wire.
[24 Jan 2011 15:05]
Bugs System
Pushed into mysql-5.5 5.5.10 (revid:georgi.kodinov@oracle.com-20110114154811-9uac3b7a9ra5ipv3) (version source revid:georgi.kodinov@oracle.com-20110114154811-9uac3b7a9ra5ipv3) (merge vers: 5.5.10) (pib:24)
[24 Jan 2011 15:06]
Bugs System
Pushed into mysql-trunk 5.6.2 (revid:georgi.kodinov@oracle.com-20110124150524-iicwnfk7dd87w85q) (version source revid:georgi.kodinov@oracle.com-20110124150524-iicwnfk7dd87w85q) (merge vers: 5.6.2) (pib:24)
[24 Jan 2011 15:19]
Paul DuBois
Noted in 5.5.10, 5.6.2 changelogs. The server and client did not always properly negotiate authentication plugin names.
Description: MYSQL 5.5 adds the possibility for different authentication schemes next to the original MySQL authentication. The name of the authentication to be used by default is sent by the server in the first packet to the client. This string is _neither_ ASCIIZ _nor_ there is a length of the string embedded beforehand. The libmysql assumes that the name will be until the end of the packet. This limits the possibility to extend the initial packet because from now on everything till its end will be the name of the authentication. This is a very serious protocol bug. How to repeat: if (scramble_data + scramble_data_len > pkt_end) scramble_data_len= pkt_end - scramble_data; this is from client.c Suggested fix: Nullterminate the string.