MySQL不安全临时文件建立漏洞_MySQL
受影响系统:
MySQL AB MySQL 4.1.0-alpha
MySQL AB MySQL 4.1.0
MySQL AB MySQL 4.0.9
MySQL AB MySQL 4.0.8
MySQL AB MySQL 4.0.7
MySQL AB MySQL 4.0.6
MySQL AB MySQL 4.0.5a
MySQL AB MySQL 4.0.5
MySQL AB MySQL 4.0.4
MySQL AB MySQL 4.0.3
MySQL AB MySQL 4.0.2
MySQL AB MySQL 4.0.15
MySQL AB MySQL 4.0.14
MySQL AB MySQL 4.0.13
MySQL AB MySQL 4.0.12
MySQL AB MySQL 4.0.11
MySQL AB MySQL 4.0.10
MySQL AB MySQL 4.0.1
MySQL AB MySQL 4.0.0
MySQL AB MySQL 3.23.9
MySQL AB MySQL 3.23.8
MySQL AB MySQL 3.23.57
MySQL AB MySQL 3.23.56
MySQL AB MySQL 3.23.55
MySQL AB MySQL 3.23.54
MySQL AB MySQL 3.23.53a
MySQL AB MySQL 3.23.53
MySQL AB MySQL 3.23.52
MySQL AB MySQL 3.23.51
MySQL AB MySQL 3.23.50
MySQL AB MySQL 3.23.5
MySQL AB MySQL 3.23.48
MySQL AB MySQL 3.23.47
MySQL AB MySQL 3.23.46
MySQL AB MySQL 3.23.45
MySQL AB MySQL 3.23.44
MySQL AB MySQL 3.23.43
MySQL AB MySQL 3.23.42
MySQL AB MySQL 3.23.41
MySQL AB MySQL 3.23.40
MySQL AB MySQL 3.23.4
MySQL AB MySQL 3.23.39
MySQL AB MySQL 3.23.38
MySQL AB MySQL 3.23.37
MySQL AB MySQL 3.23.36
MySQL AB MySQL 3.23.34
MySQL AB MySQL 3.23.31
MySQL AB MySQL 3.23.30
MySQL AB MySQL 3.23.3
MySQL AB MySQL 3.23.29
MySQL AB MySQL 3.23.28 gamma
MySQL AB MySQL 3.23.28
MySQL AB MySQL 3.23.27
MySQL AB MySQL 3.23.26
MySQL AB MySQL 3.23.25
MySQL AB MySQL 3.23.24
MySQL AB MySQL 3.23.23
MySQL AB MySQL 3.23.2
MySQL AB MySQL 3.23.10
MySQL AB MySQL 3.22.32
MySQL AB MySQL 3.22.30
MySQL AB MySQL 3.22.29
MySQL AB MySQL 3.22.28
MySQL AB MySQL 3.22.27
MySQL AB MySQL 3.22.26
MySQL AB MySQL 3.20.32a
MySQL AB MySQL 3.23.49
- Debian Linux 3.0
- Mandrake Linux 9.0
- Mandrake Linux 8.2
- Mandrake Linux 8.1
- RedHat Linux 7.3
- RedHat Linux 7.2
- SuSE Linux 8.2
- SuSE Linux 8.1
详细描述:
MySQL是一款开放源代码关系型数据库系统。MySQL错误报告工具(mysqlbug)不安全建立临时文件,本地攻击者可以利用这个漏洞破坏系统任意文件内容,造成拒绝服务攻击。
mysqlbug是错误报告脚本,运行时会启动文本编辑器,用户会被提示使用模板写入他们的错误报告。问题存在与脚本在处理用户简单的退出文本编辑器而没有更改漏洞报告的情况下,mysqlbug会执行如下代码:
--
if cmp -s $TEMP $TEMP.x
then
echo "File not changed, no bug report submitted."
cp $TEMP /tmp/failed-mysql-bugreport
echo "The raw bug report exists in
/tmp/failed-mysql-bugreport"
echo "If you use this remember that the first lines
of the report now
is a lie
.."
exit 1
fi
--
会以静态文件名建立临时文件,因此攻击者可以建立符号连接,当其他用户调用错误调试时,可导致连接的目标文件被破坏,本地攻击者可以利用这个漏洞对本地系统进行拒绝服务攻击。
补丁下载:
http://www.mysql.com/doc/en/Installing_source_tree.html
Hot AI Tools
Undress AI Tool
Undress images for free
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Solution to Windows Update prompt Error 0x8024401c error
Jun 08, 2024 pm 12:18 PM
Table of Contents Solution 1 Solution 21. Delete the temporary files of Windows update 2. Repair damaged system files 3. View and modify registry entries 4. Turn off the network card IPv6 5. Run the WindowsUpdateTroubleshooter tool to repair 6. Turn off the firewall and other related anti-virus software. 7. Close the WidowsUpdate service. Solution 3 Solution 4 "0x8024401c" error occurs during Windows update on Huawei computers Symptom Problem Cause Solution Still not solved? Recently, the web server needs to be updated due to system vulnerabilities. After logging in to the server, the update prompts error code 0x8024401c. Solution 1
Huawei's Qiankun ADS3.0 intelligent driving system will be launched in August and will be launched on Xiangjie S9 for the first time
Jul 30, 2024 pm 02:17 PM
On July 29, at the roll-off ceremony of AITO Wenjie's 400,000th new car, Yu Chengdong, Huawei's Managing Director, Chairman of Terminal BG, and Chairman of Smart Car Solutions BU, attended and delivered a speech and announced that Wenjie series models will be launched this year In August, Huawei Qiankun ADS 3.0 version was launched, and it is planned to successively push upgrades from August to September. The Xiangjie S9, which will be released on August 6, will debut Huawei’s ADS3.0 intelligent driving system. With the assistance of lidar, Huawei Qiankun ADS3.0 version will greatly improve its intelligent driving capabilities, have end-to-end integrated capabilities, and adopt a new end-to-end architecture of GOD (general obstacle identification)/PDP (predictive decision-making and control) , providing the NCA function of smart driving from parking space to parking space, and upgrading CAS3.0
Huawei will launch the Xuanji sensing system in the field of smart wearables, which can assess the user's emotional state based on heart rate
Aug 29, 2024 pm 03:30 PM
Recently, Huawei announced that it will launch a new smart wearable product equipped with Xuanji sensing system in September, which is expected to be Huawei's latest smart watch. This new product will integrate advanced emotional health monitoring functions. The Xuanji Perception System provides users with a comprehensive health assessment with its six characteristics - accuracy, comprehensiveness, speed, flexibility, openness and scalability. The system uses a super-sensing module and optimizes the multi-channel optical path architecture technology, which greatly improves the monitoring accuracy of basic indicators such as heart rate, blood oxygen and respiration rate. In addition, the Xuanji Sensing System has also expanded the research on emotional states based on heart rate data. It is not limited to physiological indicators, but can also evaluate the user's emotional state and stress level. It supports the monitoring of more than 60 sports health indicators, covering cardiovascular, respiratory, neurological, endocrine,
Xiaomi restricts national bank devices from using the international version of the system! Unable to enter the system after flashing
Jul 12, 2024 am 10:23 AM
According to news on July 9, testers of Xiaomi.EU, a well-known official version of the system, recently discovered that Xiaomi has recently taken new measures to restrict devices sold in mainland China from installing the Xiaomi international version. If a user attempts to install the international version of the system on a Chinese version of the device, the device will display an unsupported message during boot and will be unable to enter the system. This mechanism can identify the market version to which the hardware belongs. For Xiaomi mobile phones sold in mainland China, if it is detected that the international version of the system is installed, it will not be able to start normally. Test results show that the flashed device will display "Unsupported software" (unsupported software) in the boot wizard and prompt that using this version may bring security risks. Currently, Xiaomi has
Which wallet is safer for SHIB coins? (Must read for newbies)
Jun 05, 2024 pm 01:30 PM
SHIB coin is no longer unfamiliar to investors. It is a conceptual token of the same type as Dogecoin. With the development of the market, SHIB’s current market value has ranked 12th. It can be seen that the SHIB market is hot and attracts countless investments. investors participate in investment. In the past, there have been frequent transactions and wallet security incidents in the market. Many investors have been worried about the storage problem of SHIB. They wonder which wallet is safer for SHIB coins at the moment? According to market data analysis, the relatively safe wallets are mainly OKXWeb3Wallet, imToken, and MetaMask wallets, which will be relatively safe. Next, the editor will talk about them in detail. Which wallet is safer for SHIB coins? At present, SHIB coins are placed on OKXWe
What is Binance C2C? What are the risks? Is it safe? Binance C2C Coins Buying and Selling Coins Tutorial
Mar 05, 2025 pm 04:48 PM
Binance C2C Trading Guide: Safe and convenient way to deposit and withdraw money in cryptocurrency. This article will explain the Binance C2C (CustomertoCustomer) trading model in detail, explain its security, characteristics and operation procedures, and provide graphic tutorials to help you easily master the Binance C2C deposit and withdraw money in ease. What is Binance C2C? Binance C2C is a user-to-user cryptocurrency trading service provided by the Binance platform, providing users with convenient cryptocurrency and fiat currency exchange channels. Launched in 2019, the service supports multiple cryptocurrencies and fiat currency transactions through a peer-to-peer trading model, and provides enhanced security and multiple features. Compared with traditional OTC trading, Binance C2C platform authenticates both parties to the transaction and provides complete support.
Guide to secure coding in PHP frameworks
Jun 05, 2024 pm 02:32 PM
Prevent security vulnerabilities in the PHP framework: ① Use prepared statements to avoid SQL injection. ②Escape HTML content to prevent XSS attacks. ③ Filter user input to verify correctness. ④ Disable dangerous functions such as eval() and system(). ⑤Use safe_require() or require_once() for safe file inclusion.
Hack an assassin's phone in 40 minutes
Jul 20, 2024 pm 06:11 PM
According to people familiar with the matter, Cellebrite, an Israeli mobile device forensics company, provided the FBI with an evaluation version of a mobile phone cracking program that has not yet been released and is still undergoing internal testing. The FBI used it to unlock the special device in less than 40 minutes. The cellphone of Trump assassin Thomas Matthew Crooks. Agents from the FBI's Pittsburgh office initially used a commercially available Cellebrite tool to unlock Crooks' phone, but were unsuccessful. So the phone was sent to the FBI's Quantico headquarters that day. After headquarters personnel contacted key account support, Cellebrite provided an unreleased unlocking tool, allowing investigators to unlock the phone at 40


