Bug #28662 MyODBC 3/Access When linking a table using a DSN mysql system tables are shown
Submitted: 24 May 2007 21:35 Modified: 20 Jul 2007 11:37
Reporter: Erica Moss Email Updates:
Status: Closed Impact on me:
Category:Connector / ODBC Severity:S2 (Serious)
Version:3.51.14 OS:Microsoft Windows (XP sp2)
Assigned to: Jim Winstead CPU Architecture:Any
Tags: SQLTables

[24 May 2007 21:35] Erica Moss
If you link a table in Access to a mysql database using a DSN that points to a database other than the mysql database, then in the resulting "Link Tables" dialog all of the mysql system tables are displayed in addition to the tables of the requested database.

This doesn't seem to occur if the user hasn't been granted any permissions to the mysql database (although all permutations of grants have not been tried), however it does seem that this could lead to potential security problems or at least the danger of inadvertently displaying or corrupting the system tables

How to repeat:
In mysql:
GRANT SELECT ON ado.* TO 'foo'@'localhost' IDENTIFIED BY 'bar';
GRANT SELECT ON mysql.* TO 'foo'@'localhost';

In the ODBC Data Source Administrator:
Click Add
Select MyODBC 3.51 as the provider
Data Source Name = system table test
Server = localhost
User = foo
Password = bar
Database = ado

In Access:
Create a new database
Select File / Get External Data / Link Tables
Select ODBC Databases() from the "Files of Type" drop down 
Select the Machine Data Source tab
Select the "system table test" DSN
Examine the tables in the "Link Tables" dialog and note that the mysql system tables are shown in addition to the test table "t"

revoke all on mysql.* from 'foo'@'localhost';
revoke all on ado.* from 'foo'@'localhost';
drop user 'foo'@'localhost';
drop table t;
drop database ado;
[24 May 2007 22:36] Jim Winstead
this behavior is actually intentional, but i don't see how it is at all desirable. ripping out the code that does this will make me very happy.
[9 Jul 2007 17:38] Jim Winstead
Remove silly hack for SYSTEM TABLE (correct patch)

Attachment: bug28662.patch (text/plain), 12.45 KiB.

[18 Jul 2007 17:00] Jim Winstead
The fix for this bug has been committed, and will be in 3.51.18.
[20 Jul 2007 11:37] MC Brown
A note has been added to the 3.51.17 changelog: 

When connecting to a specific database using the DSN, the
system tables from the mysql database are no longer
also available.
[20 Jul 2007 11:37] MC Brown
Correction - added to the 3.51.18 changelog.
[25 Jul 2007 22:17] Jess Balint
Bug#29873 marked as a duplicate of this one.