MySQL Bugs: #62254: mysql_install_db still creates users with case sensitive hostname

Bug #62254	mysql_install_db still creates users with case sensitive hostname
Submitted:	24 Aug 2011 21:16	Modified:	11 Nov 2013 17:27
Reporter:	Hartmut Holzgraefe	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Security: Privileges	Severity:	S3 (Non-critical)
Version:	>= 5.1.53	OS:	Any
Assigned to:		CPU Architecture:	Any
Tags:	Contribution

Description:
Since the fix of bug #36742 GRANT, CREATE USER and DROP USER all lowercase the host name portion of user name argument before going to the mysql.user table, so ensuring that the actually stored host name part is always lowercase.

The mysql_system_tables_data.sql template used by mysql_install_db doesn't take into account yet that the system hostname may use upper case characters in its set hostname

How to repeat:
On the shell do "hostname FOOBAR"
then do a fresh server installation using mysql_install_db
check the mysql.user table to see that entries with the 
uppercase FOOBAR were created instead of the expected lowercase foobar

  

Suggested fix:
see attached patch file

proposed fix

Attachment: bug-62254.patch (text/x-patch), 2.22 KiB.

Thank you for the problem report and patch contributed.

(typo fix in synopsis)

This bug can also be reproduced in the following way for 5.5.13.

If a 5.1 database with upper-case hostnames is brought in to a 5.5 system via a dump, or otherwise used with an upgraded 5.5 system the hostnames will not be lowercased. When upper case hostnames are present, grant statements may create new entries in the mysql.user table corrupting authentication since the new 'grant' may create a user with no password and/or different privileges.

How come this relatively simple patch has not been applied in nearly 23 months? :(

Posted by developer:
 
"This bug is fixed as part of Bug#12917164"

Noted in 5.1.73, 5.5.35, 5.6.15, 5.7.3 changelogs.

Host names in grant tables are stored in lowercase, but
mysql_install_db could fail to observe this convention, leading to
accounts that could not be dropped with DROP USER.