--- title: "Unbreakable MySQL?" publish_date: 2013-01-31 author: "MariaDB" --- # Unbreakable MySQL? I’m getting more and more concerned about the current Oracle approach to MySQL security. And the fact that I was solely responsible for the for about ten years, doesn’t make it easier, on the contrary, it only emphasizes changes in the attitude. Starting from the obvious — somewhat slower response to critical bug fixes, which can be expected, Oracle is a big company, right? Very little information about security vulnerabilities is disclosed, [CPUs](http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html#AppendixMSQL "Oracle Critical Patch Updates") are carefully stripped from anything that might help to understand the problem, it takes hours to map them to code changes. Heck, even [test cases](http://blog.mariadb.org/disappearing-test-cases/ "Disappearing test cases or did another part of MySQL just become closed source?") are kept private now. This seriously smells[Security through Obscurity](http://en.wikipedia.org/wiki/Security_through_obscurity "if nobody knows we have a vulnerability - nobody will exploit it") to me. But all that isn’t news. Here I want to talk about the recent wave of security vulnerabilities. If you search for, say, “mysql security full-disclosure”, you will find the original postings to the mailing list, as well as further discussion and my replies. Not Oracle replies, though. In short, the vulnerabilities announced in the early December were: 1. [CVE-2012-5611](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5611) MySQL (Linux) Stack based buffer overrun PoC Zeroday 2. [CVE-2012-5612](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5612) MySQL (Linux) Heap Based Overrun PoC Zeroday 3. [CVE-2012-5613](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5613) MySQL (Linux) Database Privilege Elevation Zeroday 4. [CVE-2012-5614](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5614) MySQL Denial of Service Zeroday PoC 5. [CVE-2012-5615](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5615) MySQL Remote Preauth User Enumeration Zeroday 6. [CVE-2012-5627](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5627) MySQL Local/Remote FAST Account Password Cracking All posted to the full disclosure mailing list, accompanied by exploits in Perl. Out of these issues, the 3rd was a configuration issue (`FILE` privilege granted to untrusted user, no `--secure-file-priv` used), 4th was already fixed in the latest MariaDB and MySQL releases (the reporter used an outdated MySQL version), 1st — the most dangerous one — was already fixed in the latest MariaDB release (we were lucky to discover this issue independently few weeks ealier and immediately released a fix). Everything else was valid, exploitable, and very much public, after the original postings were quoted in various blogs and news articles. In a due time MySQL 5.5.29 is released. The 1st issue — [CVE-2012-5611](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5611 "MySQL (Linux) Stack based buffer overrun PoC Zeroday") — looks fixed. The second one — [CVE-2012-5612](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5612 "MySQL (Linux) Heap Based Overrun PoC Zeroday") — is fixed too. Hurra! But 5th and 6th vulnerabilities — [CVE-2012-5615](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5615 "MySQL Remote Preauth User Enumeration Zeroday") and[CVE-2012-5627](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5627 "MySQL Local/Remote FAST Account Password Cracking") — are not fixed. Which, apparently, leaves MySQL installations at the mercy of any [script-kiddie](http://en.wikipedia.org/wiki/Script_kiddie), who can use google. And the 1st one (the worst of all) is fixed incompletely — the fact, that is simply impossible to miss, given the amount of testing that MySQL continuous integration framework (Pushbuild2) is performing. Really, I wouldn’t expect a database vendor to blatantly ignore publicly announced vulnerabilities, that have CVE identifiers, known and easily available exploits, and were posted and reposted all over. So, Oracle, what was that, eh? **2013/Feb/05 UPDATE:**MySQL 5.5.30 doesn’t seem to fix these issues either. Two months after the vulnerabilities went public. After MariaDB 5.5.29 release (with the fixes) and this blog post! I don’t think the [Hanlon’s razor](http://en.wikipedia.org/wiki/Hanlon%27s_razor) can explain that.