MySQL Bugs: #43287: mysql user's password exposed through mysql administrator

Bug #43287	mysql user's password exposed through mysql administrator
Submitted:	1 Mar 2009 11:57	Modified:	15 Jan 2010 11:54
Reporter:	josh haglund	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Workbench	Severity:	S2 (Serious)
Version:	5.1,5.2	OS:	Any (Ubuntu 8.10, MacOSX)
Assigned to:	Alexander Musienko	CPU Architecture:	Any
Tags:	CHECKED, password, root, Security

Description:
A user running the MySQL Administrator can expose their mysql account's password to other users/processes in a system.

The problem is that the full connection info (with user/pass) is passed as an argument to the terminal window used to start the MySQL Text Console.

When the MySQL Text Console is open, any user who can run ps can see the complete connection information used to log into MySQL Administrator.

How to repeat:
Connect to a server using MySQL Administrator
Open 'Tools->MySQL Text Console'
Open a terminal window
 ~$ ps aux | grep mysql

and you will see a terminal process with all the connection info

Suggested fix:
write the mysql password to a temp file with permissions denying all but the current user read/write.

Then initiate the terminal process feeding the password in as a file path argument -- in the mysql argument list, after -p, instead of entering the password, put `cat /path/to/tmp/file/with/pass`

then cleanup -- delete the password file after successfully logging into mysql

On second thought, that suggested fix won't work.  pass would still be exposed.

Many thanks for writing a bug report. Because we are on the way to implement full functionality of MySQL Administrator into MySQL Workbench we won't fix this anymore in MySQL Administrator.

But you hint is very important for MySQL Workbench as well. 

So I will change category here and will test if our workbench release will be affected too.

I will look if this still is true for Workbench 5.2

screen shot of the password exposure

Attachment: Screen shot 2009-12-11 at 08.48.19 .png (image/png, text), 157.20 KiB.

The attached screen shot above documents the password exposure. 
The password of the remote server is "testpwd". As you can see, after the user inserts the password in a masked form, it is written clearly in the log.

Giuseppe, maybe I missed that part, but can you tell us client and server OS?
client is a box where Workbench is run,
server - respectively where server runs.
Also is it the same machine or two boxes?

Maksym,
Server and client are two Mac OSX laptops with Snow Leopard.
There are two separate machines. WB is connecting using an SSH tunnel with SSH key.

Actually, there are two password exposure problems:
* one is in the main  admin screen (where the start/stop button is), and this exposes the operating system password asked for "sudo".
* the other is in the dump screen, where the mysql user password is exposed.

Password exposing via logs is fixed.

this has been fixed in workbench 5.2 now. UI doesn't display the password anymore and we're using temp files to hold the connection info which we're passing to the client-/dump-binary.
changes will be included in 5.2.12

A 'security fix' entry has been added to the 5.2.12 changelog:

The password for the connected MySQL Server was exposed by the SQL Administrator in MySQL Workbench. The password was displayed in plain text form in the Startup Message Log on the Startup tab of the Admin page.