It is currently 20-10-2017 06:24

The Network extends useless to exploit a "vulnerability" in MySQL

The Network extends useless to exploit a "vulnerability" in MySQL

by sigismund » 2016-09-13 16:06:24


Information on two newly discovered vulnerabilities in MySQL is greatly exaggerated.


Monday, September 12, the Polish security researcher David Golonski (Dawid Golunski) reported they discovered two critical vulnerabilities in MySQL (CVE-2016-6662 and CVE-2016-6663), which allows to obtain full control over the database and presented PoC-exploit for them. However, there is reason to believe that Golunski discovered vulnerabilities are not, and the exploit is ineffective.

Submitted by the researcher to exploit vulnerabilities in MySQL involving a "remote code execution" implies access to the vulnerable system with privileges sufficient to edit the MySQL configuration files (my.cnf). By default, these privileges has superuser if MySQL was installed on the system with the default settings.
Edition SecurityLab has not been known to install the latest version of MySQL with insecure privileges to access configuration files in modern OS distributions, where MySQL comes as a package.

For the exploitation of the described vulnerability requires permissions to edit the configuration file (with root permissions). That is, it is assumed that the user already has elevated privileges on the system or access rights to the file has been changed intentionally to allow changing the file the attacker.
sigismund
moderators
Сообщений: 788
Депозит: 0 BTC

Rating: 5