Slashdot Mirror
Two Critical MySQL Bugs Discovered (infoworld.com)
An anonymous reader quotes InfoWorld:
Two critical privilege escalation vulnerabilities in MySQL, MariaDB, and PerconaDB can help take control of the whole server, which is very bad for shared environments... Administrators need to check their database versions, as attackers can chain two critical vulnerabilities and completely take over the server hosting the database...
The first vulnerability, a privilege escalation/race condition flaw, gives elevated privileges to a local system user with access to a database and allows them to execute arbitrary code as the database system user. This gives an attacker access to all of the databases on the affected server... The privilege escalation/race condition flaw can be chained with another critical vulnerability, a root privilege escalation vulnerability, to further elevate the system level user to gain root on the server.
Oracle is unbreakable.
Signed,
Larry
MySQL runs a thread or process as root? Why?
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
So an exploit usable after you've gained local access?
Who the hell still uses MySQL/its derivatives in 2016? So many vastly superior SQL server options exist and you still go with this hacked together pile of shit we were using half-heartedly years and years ago? Mon Dieu. As much as I hate to admit it, even fucking MICROSOFT SQL SERVER is better.
MySQL is not webscale. Why didn't you use MongoDB? MongoDB is a web scale database, and doesn't use SQL or JOINs, so it's high-performance. Everybody knows that relational databases don't scale because they use JOINs and write to disk. Relational databases weren't built for web scale. MongoDB handles web scale. You turn it on and it scales right up. MySQL is slow as a dog. MongoDB will run circles around MySQL because MongoDB is web scale.
Wondering, how this can be used to help me get a date with Ariel Winter?
Sure , MongoDB is fast. But having used it after spending years with relational DBs my opinion of it is its a little more than a toy thats one step up from a flat file and is bascially a throwback to what existed back in the 70s before RDBs came along.
If all you want is a key value store then knock yourself out, but if you want proper relational operations - and don't say they're not important, they damn well are in any serious business data - then forget it. Mongo has some relational operators hacked in and the latest versions can do a piss poor simulcra of a join between collections but these can't use an index so are essentially useless for high speed operations. Also Mongo doesn't support transactions making dirty reads possible and hence its useless for simultanious multiclient operations on critical data. And don't get me started on its hideous bastard stepchild of javascript command line making even the simplest query a PITA exercise in bracket counting.
"MongoDB will run circles around MySQL because MongoDB is web scale."
Dishing up noddy website data is pretty much all its any use for.
Apparently you are unaware of this... https://www.youtube.com/watch?...
I tip my hat to you, Sir. Thank you for saying all that.
Is there a transcript available?
English is not my first language and I'm having a lot of trouble making out the computer-synthesised voices ...
Both of these vulnerabilities were fixed in MySQL two months ago. I assume MariaDB and Percona have long since applied the patches as well.
So the big takeaway here is, "If you've not upgraded to the latest release yet, why the hell not?"
Il n'y a pas de Planet B.
Youtube's automatic captioning works beautifully with that computer-generated voices.
https://2ndquadrant.com/en/res...
You're welcome.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Postgresql-XC http://postgres-xc.sourceforge...
You're welcome.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
And use jails. I don't seem to have this problem. Oh what is this SystemD I keep hearing about too?
http://saveie6.com/
"If all you want is a key value store then knock yourself out..."
Yeah, proper tool for the job and all that. "MongoDB is schemaless" my ass. More like "Your schema is enforced in your application code using ad-hoc hand-coded enforcement mechanisms.".
Are you aware of https://aphyr.com/tags/Jepsen ? Fun reading!
Correct an as soon as they get thr bdr exstension for posgresql 9.6 out rhe dor you will ( if i understtand correctly) need a modified verson of postgres either, just a few config parameters and an extension in the db you wan to repliicate
Sure , MongoDB is fast.
The problem with Mongo is that it's ruled by Ming the Merciless.
On the other hand, MySQL is ruled by Larry Ellison, so..... euh, Mongo it is then.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
Can someone explain to me if it is common practice to expose the IP address of the SQL data base server? I've set up MySQL a couple of times but I'm no expert but that just seems like asking for it to me.
Obvious propaganda.
As others have pointed out, it was fixed. And since the creators/inventors of MySQL, created and now working on MariaDB, we arlready know the first thing they did was to fix a bunch of crap they were prevented by Sun/Oracle to fix with MySQL.
Just say NO to Oracle and Microsoft Sequel Sever.