Slashdot Mirror
Two Critical MySQL Bugs Discovered (infoworld.com)
An anonymous reader quotes InfoWorld:
Two critical privilege escalation vulnerabilities in MySQL, MariaDB, and PerconaDB can help take control of the whole server, which is very bad for shared environments... Administrators need to check their database versions, as attackers can chain two critical vulnerabilities and completely take over the server hosting the database...
The first vulnerability, a privilege escalation/race condition flaw, gives elevated privileges to a local system user with access to a database and allows them to execute arbitrary code as the database system user. This gives an attacker access to all of the databases on the affected server... The privilege escalation/race condition flaw can be chained with another critical vulnerability, a root privilege escalation vulnerability, to further elevate the system level user to gain root on the server.
Oracle is unbreakable.
Signed,
Larry
MySQL runs a thread or process as root? Why?
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
So an exploit usable after you've gained local access?
MySQL is not webscale. Why didn't you use MongoDB? MongoDB is a web scale database, and doesn't use SQL or JOINs, so it's high-performance. Everybody knows that relational databases don't scale because they use JOINs and write to disk. Relational databases weren't built for web scale. MongoDB handles web scale. You turn it on and it scales right up. MySQL is slow as a dog. MongoDB will run circles around MySQL because MongoDB is web scale.
Wondering, how this can be used to help me get a date with Ariel Winter?
Apart from Postgres, I don't know any other. Care to share some names?
People use MySQL because that's what providers make available to them on cheap hosting solutions.
Sure , MongoDB is fast. But having used it after spending years with relational DBs my opinion of it is its a little more than a toy thats one step up from a flat file and is bascially a throwback to what existed back in the 70s before RDBs came along.
If all you want is a key value store then knock yourself out, but if you want proper relational operations - and don't say they're not important, they damn well are in any serious business data - then forget it. Mongo has some relational operators hacked in and the latest versions can do a piss poor simulcra of a join between collections but these can't use an index so are essentially useless for high speed operations. Also Mongo doesn't support transactions making dirty reads possible and hence its useless for simultanious multiclient operations on critical data. And don't get me started on its hideous bastard stepchild of javascript command line making even the simplest query a PITA exercise in bracket counting.
"MongoDB will run circles around MySQL because MongoDB is web scale."
Dishing up noddy website data is pretty much all its any use for.
MySQL and its metastases is just non-standard enough. Once you use it, you're stuck with it or you get to start over.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Firebird.
SQLite works too but it doesn't exactly run as a server ...
Indeedy, I learnt Postgres over ten years ago, when 8.0 was current.
I chose it largely because people were touting it as better than MySQL. I didn't know any SQL back then, but I had a fairly simple PHP/MySQL app I could port over. The porting taught me quite a bit.
Today, if I were to start from zero again and had the time, I'd learn Firebird. Not that there's anything wrong with Pg, I'd do it just out of curiosity. If the Moscow stock exchange runs it, it must be pretty damn powerful ...
Multi-master replication across multiple datacenters for high availability and low latency reads. How many databases have this feature right now?
Apparently you are unaware of this... https://www.youtube.com/watch?...
I tip my hat to you, Sir. Thank you for saying all that.
The ones that aren't free.
Is there a transcript available?
English is not my first language and I'm having a lot of trouble making out the computer-synthesised voices ...
Ingres.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Both of these vulnerabilities were fixed in MySQL two months ago. I assume MariaDB and Percona have long since applied the patches as well.
So the big takeaway here is, "If you've not upgraded to the latest release yet, why the hell not?"
Il n'y a pas de Planet B.
Youtube's automatic captioning works beautifully with that computer-generated voices.
https://2ndquadrant.com/en/res...
You're welcome.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Postgresql-XC http://postgres-xc.sourceforge...
You're welcome.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
People use MySQL mostly because of habit or name recognition; but also because it's very hard for most people to tell the difference between a correctly implemented RDBMS and an RDBMS that has a 1/10000 chance of randomly corrupting your data. You can cite a long list of things that are wrong with MySQL implemented better in Postgres, but for the average developer who just wants to write a web app and knows little about SQL, it's all too abstract. "Who cares, I've used MySQL for years and never lost data."
average developer who just wants to write a web app and knows little about SQL
It's a shame that so few developers learn SQL beyond the very very basic SELECT, INSERT, UPDATE. They probably don't know about joins, and wouldn't know a transaction if it bit them ...
Well, I guess that for them, MySQL is a good fit. For the rest of us, real databases exist.
(OK, OK, I haven't touched MySQL in ages and I guess it must have improved somewhere along the way. It can't be all that bad these days, if you bother to fix the default settings first)
And use jails. I don't seem to have this problem. Oh what is this SystemD I keep hearing about too?
http://saveie6.com/
"If all you want is a key value store then knock yourself out..."
Yeah, proper tool for the job and all that. "MongoDB is schemaless" my ass. More like "Your schema is enforced in your application code using ad-hoc hand-coded enforcement mechanisms.".
Are you aware of https://aphyr.com/tags/Jepsen ? Fun reading!
Correct an as soon as they get thr bdr exstension for posgresql 9.6 out rhe dor you will ( if i understtand correctly) need a modified verson of postgres either, just a few config parameters and an extension in the db you wan to repliicate
Sure , MongoDB is fast.
The problem with Mongo is that it's ruled by Ming the Merciless.
On the other hand, MySQL is ruled by Larry Ellison, so..... euh, Mongo it is then.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
Can someone explain to me if it is common practice to expose the IP address of the SQL data base server? I've set up MySQL a couple of times but I'm no expert but that just seems like asking for it to me.
I have developed and admind and MySQL and they both have their place. Pg isn't better at everything. Innodb buffer pool craps over pg's caching. Mysql's replication is better for some situstions. Pg is better at json and geo. Anyone who is regilious about either is a fool.
Obvious propaganda.
As others have pointed out, it was fixed. And since the creators/inventors of MySQL, created and now working on MariaDB, we arlready know the first thing they did was to fix a bunch of crap they were prevented by Sun/Oracle to fix with MySQL.
Just say NO to Oracle and Microsoft Sequel Sever.