Full Disclosure mailing list archives
Re[2]: User bypass privs for Mysql??
From: npguy <npguy () websurfer com np>
Date: Wed, 19 May 2004 08:04:27 +0545
Hi Joel, can u submit your mysql `users` table. Tuesday, May 18, 2004, 10:17:03 PM, you wrote: EJC> Could be. I didn't check, just was weird when I did it. EJC> -----Original Message----- EJC> From: Michael Gargiullo [mailto:mgargiullo () warpdrive net] EJC> Sent: Tuesday, May 18, 2004 12:35 PM EJC> To: Esler, Joel - Contractor EJC> Cc: full-disclosure () lists netsys com EJC> Subject: Re: [Full-disclosure] User bypass privs for Mysql?? EJC> On Tue, 2004-05-18 at 10:02, Esler, Joel - Contractor wrote:
Not having any grant permissions. I went into the mysql/user table
EJC> and
edited the Grant from N to Y. Logged out and logged back in, and I
EJC> had
full privs including Grant. I shouldn't be able to do this... Joel
EJC> but does your user have update permissions on either *.* or mysql.* EJC> etc... If as the root mysql user you give update permissions to the EJC> mysql.users table to a user, they can update themselves to what ever EJC> they want. EJC> _______________________________________________ EJC> Full-Disclosure - We believe in it. EJC> Charter: http://lists.netsys.com/full-disclosure-charter.html npguy npguy€websurfer.com.np _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- User bypass privs for Mysql?? Esler, Joel - Contractor (May 18)
- Re: User bypass privs for Mysql?? James Bliss (May 18)
- Re: User bypass privs for Mysql?? Ben Nelson (May 18)
- RE: User bypass privs for Mysql?? Remko Lodder (May 18)
- Re: User bypass privs for Mysql?? Michael Gargiullo (May 18)
- <Possible follow-ups>
- RE: User bypass privs for Mysql?? Esler, Joel - Contractor (May 18)
- Re: User bypass privs for Mysql?? Maarten (May 18)
- Re: User bypass privs for Mysql?? Ben Nelson (May 18)
- RE: User bypass privs for Mysql?? Esler, Joel - Contractor (May 18)
- Re[2]: User bypass privs for Mysql?? npguy (May 18)