Actu
Vigil@nce: MySQL, access to UNINSTALL PLUGIN
April 2010 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
MySQL users can use UNINSTALL PLUGIN, even if they do not have the
DELETE privilege.
– Severity: 1/4
– Creation date: 20/04/2010
DESCRIPTION OF THE VULNERABILITY
The INSTALL PLUGIN query is used to add plugins to MySQL.
The UNINSTALL PLUGIN query uninstalls these plugins. The help page
indicates that the user has to be granted the DELETE privilege on
the mysql.plugin table to execute UNINSTALL PLUGIN.
However, the mysql_uninstall_plugin() function of the
sql/sql_plugin.cc file does not check if the user has the
privilege.
MySQL users can therefore use UNINSTALL PLUGIN, even if they do
not have the DELETE privilege. This vulnerability can for example
lead to a denial of service.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/MySQL-access-to-UNINSTALL-PLUGIN-9598
