-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

      ESB-2004.0446 -- NGSSoftware Insight Security Research Advisory
                        MySQL Authentication Bypass
                               06 July 2004

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                MySQL 4.1 prior to 4.1.3
                        MySQL 5.0
Publisher:              NGSSoftware
Impact:                 Increased Privileges
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

NGSSoftware Insight Security Research Advisory

Name: MySQL Authentication Bypass / Buffer Overflow
Systems Affected: MySQL 4.1 prior to 4.1.3, and MySQL 5.0.
Severity: High
Vendor URL: http://www.mysql.com
Author: Chris Anley [ chris@ngssoftware.com ]
Date of Advisory: 1st July 2004

Whitepaper
**********

We have written a paper that accompanies this advisory. The paper
provides details of various MySQL lockdown techniques, and a review of
common attacks on MySQL, including SQL injection. The paper can be found
at

http://www.ngssoftware.com/papers/HackproofingMySQL.pdf

Description
***********

"The MySQL database server is the world's most popular open source
database." [www.mysql.com].

This advisory details a bug that allows a remote user to entirely bypass
the MySQL password authentication mechanism, allowing them to authenticate
as a MySQL user without knowing that user's password. Using a similar
method, a stack buffer used in the authentication mechanism can be
overflowed, though exploitation of the overflow is not straightforward.

Details
*******

MySQL 4.1 Authentication Bypass

By submitting a carefully crafted authentication packet, it is possible
for an attacker to bypass password authentication in MySQL 4.1.

- From check_connection (sql_parse.cpp), line ~837:

  /*
    Old clients send null-terminated string as password; new clients send
    the size (1 byte) + string (not null-terminated). Hence in case of
empty
    password both send '\0'.
  */
  uint passwd_len= thd->client_capabilities & CLIENT_SECURE_CONNECTION ?
    *passwd++ : strlen(passwd);


Provided 0x8000 is specified in the client capabilities flags, the use can
specify the passwd_len field of their choice. For this attack, we will
choose 0x14 (20) which is the expected SHA1 hash length.

Several checks are now carried out to ensure that the user is
authenticating from a host that is permitted to connect. Provided these
checks are passed, we reach:

        /* check password: it should be empty or valid */
        if (passwd_len == acl_user_tmp->salt_len)
        {
          if (acl_user_tmp->salt_len == 0 ||
              acl_user_tmp->salt_len == SCRAMBLE_LENGTH &&
              check_scramble(passwd, thd->scramble, acl_user_tmp->salt) == 0 ||
              check_scramble_323(passwd, thd->scramble,
                                 (ulong *) acl_user_tmp->salt) == 0)
          {
            acl_user= acl_user_tmp;
            res= 0;
          }
        }


the check_scramble function fails, but within the check_scramble_323
function we see:

my_bool
check_scramble_323(const char *scrambled, const char *message,
                   ulong *hash_pass)
{
  struct rand_struct rand_st;
  ulong hash_message[2];
  char buff[16],*to,extra;                      /* Big enough for check */
  const char *pos;

  hash_password(hash_message, message, SCRAMBLE_LENGTH_323);
  randominit(&rand_st,hash_pass[0] ^ hash_message[0],
             hash_pass[1] ^ hash_message[1]);
  to=buff;
  for (pos=scrambled ; *pos ; pos++)
    *to++=(char) (floor(my_rnd(&rand_st)*31)+64);
  extra=(char) (floor(my_rnd(&rand_st)*31));
  to=buff;
  while (*scrambled)
  {
    if (*scrambled++ != (char) (*to++ ^ extra))
      return 1;                                 /* Wrong password */
  }
  return 0;
}


At this point, the user has specified a 'scrambled' string that is as long
as they wish. In the case of the straightforward authentication bypass,
this is a zero-length string. The final loop compares each character in
the 'scrambled' string against the string that mysql knows is the correct
response, until there are no more characters in 'scrambled'. Since there
are no characters *at all* in 'scrambled', the function returns '0'
immediately, allowing the user to authenticate with a zero-length string.

This bug is relatively easy to exploit, although it is necessary to write
a custom MySQL client in order to do so.

In addition to the zero-length string authentication bypass, the
stack-based buffer 'buff' can be overflowed by a long 'scramble' string.
The buffer is overflowed with characters output from my_rnd(), a pseudo
random number generator. The characters are in the range 0x40..0x5f. On
some platforms, arbitrary code execution is possible, though the exploit
is complex and requires either brute force, or knowledge of at least one
password hash.

Fix Information and workarounds
*******************************

MySQL AB were contacted on the 1st of June 2004 and the patch for this bug
was present in the source code by the 2nd of June. Since MySQL prefer
users to install via pre-built binary packages, NGS have delayed the
release of this advisory until appropriate 'patch' packages were
available.

MySQL AB have fixed this bug in version 4.1.3, and the most recent builds
of version 5.0.

In addition to patching, various workarounds are possible for this bug.
The attacker must know or be able to guess the name of a user in order
for this attack to work, so renaming the default MySQL 'root' account is
a reasonable precaution. Also, the account in question must be accessible
from the attacker's host, so applying ip-address based login restrictions
will also mitigate this bug.

A check for this vulnerability has been added to Typhon III, NGSSoftware's
advanced vulnerability assessment scanner. For more information please
visit the NGSSoftware website at http://www.ngssoftware.com/


About NGSSoftware
*****************

NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware
have offices in the South of London and the East Coast of Scotland.
NGSSoftware's sister company NGSConsulting, offers best of breed security
consulting services, specializing in application, host and network
security assessments.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQOpBcyh9+71yA2DNAQIF6AQAiE1I3yJAX+wIKkUhUujPB/9+3mYc0aa8
dvpabv13HJWOjcOlpL7gDDy15fvAk7uZgsy5HISHw8qcaGuF8bHdblMODPRIxqMd
DlYDIOt11Ny/L+NOUF0EJvu1IBAX+bHC8mK8EBDgqC6vr/R5W+ZpVWKZGOFFuN5e
qIN4gz9V6Fc=
=iGUm
-----END PGP SIGNATURE-----