{"id":204,"date":"2016-11-03T17:05:14","date_gmt":"2016-11-03T17:05:14","guid":{"rendered":"http:\/\/www.urolime.com\/blogs\/in\/?p=204"},"modified":"2021-09-20T10:56:22","modified_gmt":"2021-09-20T05:26:22","slug":"mysql-remote-root-code-execution","status":"publish","type":"post","link":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/","title":{"rendered":"Mysql Remote Root Code Execution"},"content":{"rendered":"

Remote Root Code Execution \/ Databse Privilege Escalation:<\/strong><\/p>\n

\"database-security\"<\/a>
\nSeverity: Critical<\/strong> CVE-2016-6662 CVE-2016-6663<\/p>\n

Privilege Escalation<\/strong> vulnerability is reported. Using this vulnerability, an attacker<\/span> could execute code with root privileges.<\/p>\n

Using the REPAIR TABLE SQL statement,<\/span> which have the lowest<\/span> privileged users with SELECT\/CREATE\/INSERT grants, can create a simlink to the database directory( that is \/var\/lib\/mysql). After that they will get the arbitrary code execution in mysql shell.<\/p>\n

Affected Databse versions:<\/p>\n

MariaDB : Earlier versions are affected.
\n5.5.52
\n10.1.18
\n10.0.28<\/p><\/blockquote>\n

MySQL : Same and earlier versions are affected.
\n5.5.51
\n5.6.32
\n5.7.14<\/p><\/blockquote>\n

Percona Server : Earlier versions are affected
\n5.5.51-38.2
\n5.6.32-78-1
\n5.7.14-8<\/p><\/blockquote>\n

If MySQL config files are owned by mysql then the attacker can append his malicious entries.<\/p>\n

Attacker could run the following SQL queries:<\/p>\n

mysql> set global general_log_file = ‘\/etc\/my.cnf’;
\nmysql> set global general_log = on;
\nmysql> select ‘
\n‘>
\n‘> ; injected config entry
\n‘>
\n‘> [mysqld]
\n‘> malloc_lib=\/tmp\/mysql_exploit_lib.so
\n‘>
\n‘> [separator]
\n‘>
\n‘> ‘;
\n1 row in set (0.00 sec)
\nmysql> set global general_log = off;<\/p><\/blockquote>\n

And if the mysql config file is not owned by the mysql user , then the attacker can set the config file using the SQL command.<\/p>\n

SELECT ‘malicious config entry’ INTO OUTFILE ‘\/var\/lib\/mysql\/my.cnf’<\/p><\/blockquote>\n

FIX:<\/strong>
\nYou need to upgrade the mysql version.<\/p>\n

MySQL
\n5.7.15
\n5.6.33
\n5.5.52<\/p>\n

https:\/\/dev.mysql.com\/doc\/relnotes\/mysql\/5.7\/en\/news-5-7-15.html
\nhttps:\/\/dev.mysql.com\/doc\/relnotes\/mysql\/5.6\/en\/news-5-6-33.html
\nhttps:\/\/dev.mysql.com\/doc\/relnotes\/mysql\/5.5\/en\/news-5-5-52.html<\/p><\/blockquote>\n

MariaDB
\n5.5.52
\n10.1.18
\n10.0.28
\nhttps:\/\/mariadb.com\/kb\/en\/mdb-5552-rn\/
\nhttps:\/\/mariadb.com\/kb\/en\/mdb-10118-rn\/
\nhttps:\/\/mariadb.com\/kb\/en\/mdb-10028-rn\/<\/p><\/blockquote>\n

Create an empty my.cnf and .my.cnf in the datadir (usually \/var\/lib\/mysql) and make root the owner\/group with 0644 permissions.<\/p>\n

UROLIME<\/a> is highly recommended to upgrade all your database servers to the latest patched version and make sure attacker is not able to write his malicious code to your Config files.<\/p>\n

<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n","protected":false},"excerpt":{"rendered":"

Remote Root Code Execution \/ Databse Privilege Escalation: Severity: Critical CVE-2016-6662 CVE-2016-6663 Privilege Escalation vulnerability is reported. Using this vulnerability, an attacker could execute code with root privileges. Using the REPAIR TABLE SQL statement, which have the lowest privileged users with SELECT\/CREATE\/INSERT grants, can create a simlink to the database directory( that is \/var\/lib\/mysql). After […]<\/p>\n

<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","sfsi_plus_gutenberg_text_before_share":"","sfsi_plus_gutenberg_show_text_before_share":"","sfsi_plus_gutenberg_icon_type":"","sfsi_plus_gutenberg_icon_alignemt":"","sfsi_plus_gutenburg_max_per_row":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-204","post","type-post","status-publish","format-standard","hentry","category-general"],"yoast_head":"\nMysql Remote Root Code Execution<\/title>\n<meta name=\"description\" content=\"Privilege Escalation vulnerability is reported. Using this vulnerability, an attacker could execute code with root privileges.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Mysql Remote Root Code Execution\" \/>\n<meta property=\"og:description\" content=\"Remote Root Code Execution \/ Databse Privilege Escalation: Severity: Critical CVE-2016-6662 CVE-2016-6663 Privilege Escalation vulnerability is reported. Using this vulnerability, an attacker could execute code with root privileges. Using the REPAIR TABLE SQL statement, which have the lowest privileged users with SELECT\/CREATE\/INSERT grants, can create a simlink to the database directory( that is \/var\/lib\/mysql). After \u2026\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/\" \/>\n<meta property=\"og:site_name\" content=\"Urolime Blogs\" \/>\n<meta property=\"article:published_time\" content=\"2016-11-03T17:05:14+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-20T05:26:22+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2016\/11\/database-security-300x225.jpg\" \/>\n<meta name=\"author\" content=\"Urolime Technologies\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Urolime Technologies\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/\"},\"author\":{\"name\":\"Urolime Technologies\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/person\/c231f59d5f2c2516e0efc6067ee0c22c\"},\"headline\":\"Mysql Remote Root Code Execution\",\"datePublished\":\"2016-11-03T17:05:14+00:00\",\"dateModified\":\"2021-09-20T05:26:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/\"},\"wordCount\":346,\"publisher\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2016\/11\/database-security-300x225.jpg\",\"articleSection\":[\"General\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/\",\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/\",\"name\":\"Mysql Remote Root Code Execution\",\"isPartOf\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2016\/11\/database-security-300x225.jpg\",\"datePublished\":\"2016-11-03T17:05:14+00:00\",\"dateModified\":\"2021-09-20T05:26:22+00:00\",\"description\":\"Privilege Escalation vulnerability is reported. Using this vulnerability, an attacker could execute code with root privileges.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#primaryimage\",\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2016\/11\/database-security.jpg\",\"contentUrl\":\"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2016\/11\/database-security.jpg\",\"width\":450,\"height\":338,\"caption\":\"database security\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.urolime.com\/blogs\/in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Mysql Remote Root Code Execution\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#website\",\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/\",\"name\":\"Urolime Blogs\",\"description\":\"The place for DevOps, Cloud, Kubernetes News and Updates\",\"publisher\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.urolime.com\/blogs\/in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#organization\",\"name\":\"Urolime Blogs\",\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2021\/06\/cropped-250-x250.jpg\",\"contentUrl\":\"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2021\/06\/cropped-250-x250.jpg\",\"width\":250,\"height\":73,\"caption\":\"Urolime Blogs\"},\"image\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/person\/c231f59d5f2c2516e0efc6067ee0c22c\",\"name\":\"Urolime Technologies\",\"description\":\"Urolime Technologies has made groundbreaking accomplishments in the field of Google Cloud & Kubernetes Consulting, DevOps Services, 24\/7 Managed Services & Support, Dedicated IT Team, Managed AWS Consulting and Azure Cloud Consulting. We believe our customers are Smart to choose their IT Partner, and we \u201cDo IT Smart\u201d.\",\"sameAs\":[\"https:\/\/www.urolime.com\/\"],\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/author\/blogadmin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Mysql Remote Root Code Execution","description":"Privilege Escalation vulnerability is reported. Using this vulnerability, an attacker could execute code with root privileges.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/","og_locale":"en_US","og_type":"article","og_title":"Mysql Remote Root Code Execution","og_description":"Remote Root Code Execution \/ Databse Privilege Escalation: Severity: Critical CVE-2016-6662 CVE-2016-6663 Privilege Escalation vulnerability is reported. Using this vulnerability, an attacker could execute code with root privileges. Using the REPAIR TABLE SQL statement, which have the lowest privileged users with SELECT\/CREATE\/INSERT grants, can create a simlink to the database directory( that is \/var\/lib\/mysql). After \u2026","og_url":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/","og_site_name":"Urolime Blogs","article_published_time":"2016-11-03T17:05:14+00:00","article_modified_time":"2021-09-20T05:26:22+00:00","og_image":[{"url":"http:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2016\/11\/database-security-300x225.jpg","type":"","width":"","height":""}],"author":"Urolime Technologies","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Urolime Technologies","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#article","isPartOf":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/"},"author":{"name":"Urolime Technologies","@id":"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/person\/c231f59d5f2c2516e0efc6067ee0c22c"},"headline":"Mysql Remote Root Code Execution","datePublished":"2016-11-03T17:05:14+00:00","dateModified":"2021-09-20T05:26:22+00:00","mainEntityOfPage":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/"},"wordCount":346,"publisher":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/#organization"},"image":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#primaryimage"},"thumbnailUrl":"http:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2016\/11\/database-security-300x225.jpg","articleSection":["General"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/","url":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/","name":"Mysql Remote Root Code Execution","isPartOf":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#primaryimage"},"image":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#primaryimage"},"thumbnailUrl":"http:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2016\/11\/database-security-300x225.jpg","datePublished":"2016-11-03T17:05:14+00:00","dateModified":"2021-09-20T05:26:22+00:00","description":"Privilege Escalation vulnerability is reported. Using this vulnerability, an attacker could execute code with root privileges.","breadcrumb":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#primaryimage","url":"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2016\/11\/database-security.jpg","contentUrl":"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2016\/11\/database-security.jpg","width":450,"height":338,"caption":"database security"},{"@type":"BreadcrumbList","@id":"https:\/\/www.urolime.com\/blogs\/in\/mysql-remote-root-code-execution\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.urolime.com\/blogs\/in\/"},{"@type":"ListItem","position":2,"name":"Mysql Remote Root Code Execution"}]},{"@type":"WebSite","@id":"https:\/\/www.urolime.com\/blogs\/in\/#website","url":"https:\/\/www.urolime.com\/blogs\/in\/","name":"Urolime Blogs","description":"The place for DevOps, Cloud, Kubernetes News and Updates","publisher":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.urolime.com\/blogs\/in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.urolime.com\/blogs\/in\/#organization","name":"Urolime Blogs","url":"https:\/\/www.urolime.com\/blogs\/in\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/logo\/image\/","url":"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2021\/06\/cropped-250-x250.jpg","contentUrl":"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2021\/06\/cropped-250-x250.jpg","width":250,"height":73,"caption":"Urolime Blogs"},"image":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/person\/c231f59d5f2c2516e0efc6067ee0c22c","name":"Urolime Technologies","description":"Urolime Technologies has made groundbreaking accomplishments in the field of Google Cloud & Kubernetes Consulting, DevOps Services, 24\/7 Managed Services & Support, Dedicated IT Team, Managed AWS Consulting and Azure Cloud Consulting. We believe our customers are Smart to choose their IT Partner, and we \u201cDo IT Smart\u201d.","sameAs":["https:\/\/www.urolime.com\/"],"url":"https:\/\/www.urolime.com\/blogs\/in\/author\/blogadmin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/posts\/204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/comments?post=204"}],"version-history":[{"count":6,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/posts\/204\/revisions"}],"predecessor-version":[{"id":2402,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/posts\/204\/revisions\/2402"}],"wp:attachment":[{"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/media?parent=204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/categories?post=204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/tags?post=204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}