Bug #62254 mysql_install_db still creates users with case sensitive hostname
Submitted: 24 Aug 2011 21:16 Modified: 11 Nov 2013 17:27
Reporter: Hartmut Holzgraefe Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: Security: Privileges Severity:S3 (Non-critical)
Version:>= 5.1.53 OS:Any
Assigned to: CPU Architecture:Any
Tags: Contribution
Triage: Needs Triage: D3 (Medium)

[24 Aug 2011 21:16] Hartmut Holzgraefe
Description:
Since the fix of bug #36742 GRANT, CREATE USER and DROP USER all lowercase the host name portion of user name argument before going to the mysql.user table, so ensuring that the actually stored host name part is always lowercase.

The mysql_system_tables_data.sql template used by mysql_install_db doesn't take into account yet that the system hostname may use upper case characters in its set hostname

How to repeat:
On the shell do "hostname FOOBAR"
then do a fresh server installation using mysql_install_db
check the mysql.user table to see that entries with the 
uppercase FOOBAR were created instead of the expected lowercase foobar

  

Suggested fix:
see attached patch file
[24 Aug 2011 21:18] Hartmut Holzgraefe
proposed fix

Attachment: bug-62254.patch (text/x-patch), 2.22 KiB.

[25 Aug 2011 3:22] Valeriy Kravchuk
Thank you for the problem report and patch contributed.
[25 Aug 2011 10:12] Hartmut Holzgraefe
(typo fix in synopsis)
[23 Feb 2012 16:16] Aaron Hunter
This bug can also be reproduced in the following way for 5.5.13.

If a 5.1 database with upper-case hostnames is brought in to a 5.5 system via a dump, or otherwise used with an upgraded 5.5 system the hostnames will not be lowercased. When upper case hostnames are present, grant statements may create new entries in the mysql.user table corrupting authentication since the new 'grant' may create a user with no password and/or different privileges.
[9 Jul 2013 22:32] Jay Pipes
How come this relatively simple patch has not been applied in nearly 23 months? :(
[31 Oct 2013 19:16] Murthy Sidagam
Posted by developer:
 
"This bug is fixed as part of Bug#12917164"
[11 Nov 2013 17:27] Paul Dubois
Noted in 5.1.73, 5.5.35, 5.6.15, 5.7.3 changelogs.

Host names in grant tables are stored in lowercase, but
mysql_install_db could fail to observe this convention, leading to
accounts that could not be dropped with DROP USER.