Commit 0d01b853 authored by Otto Kekäläinen's avatar Otto Kekäläinen
Browse files

Remove all old passwordless root account lines when using unix auth

This closes a potential security vulnerability. In bug report at
https://bugs.launchpad.net/ubuntu/+source/mariadb-10.0/+bug/1561062
it was pointed out, that is name resolve is skipped and TCP is
forced, localhost users can being detected as connecting via host
localhost and the passwordless root lines would apply and let
user inside. This is not intended and potentially dangerous,
so remove the lines. They are most likely useless and legacy
anyway.
parent 67008ea3
...@@ -5,6 +5,8 @@ mariadb-10.0 (10.0.24-6) UNRELEASED; urgency=low ...@@ -5,6 +5,8 @@ mariadb-10.0 (10.0.24-6) UNRELEASED; urgency=low
* Add breaks/replaces for mariadb-client to accommodate the above. * Add breaks/replaces for mariadb-client to accommodate the above.
* Add conflicts/breaks/replaces for MySQL 5.7 series packages now * Add conflicts/breaks/replaces for MySQL 5.7 series packages now
when mysql-5.7 entered the Ubuntu repositories (LP: #1568285). when mysql-5.7 entered the Ubuntu repositories (LP: #1568285).
* Remove all old passwordless root account lines to close a potential
security vulnerability (LP: #1561062).
-- Otto Kekäläinen <otto@debian.org> Sat, 09 Apr 2016 14:47:22 +0300 -- Otto Kekäläinen <otto@debian.org> Sat, 09 Apr 2016 14:47:22 +0300
......
...@@ -10,12 +10,14 @@ Bug: https://jira.mariadb.org/browse/MDEV-8375 ...@@ -10,12 +10,14 @@ Bug: https://jira.mariadb.org/browse/MDEV-8375
--- a/scripts/mysql_system_tables_data.sql --- a/scripts/mysql_system_tables_data.sql
+++ b/scripts/mysql_system_tables_data.sql +++ b/scripts/mysql_system_tables_data.sql
@@ -29,7 +29,7 @@ SELECT LOWER( REPLACE((SELECT REPLACE(@@ @@ -29,10 +29,7 @@
-- Fill "user" table with default users allowing root access -- Fill "user" table with default users allowing root access
-- from local machine if "user" table didn't exist before -- from local machine if "user" table didn't exist before
CREATE TEMPORARY TABLE tmp_user LIKE user; CREATE TEMPORARY TABLE tmp_user LIKE user;
-INSERT INTO tmp_user VALUES ('localhost','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N', 'N'); -INSERT INTO tmp_user VALUES ('localhost','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N', 'N');
-REPLACE INTO tmp_user SELECT @current_hostname,'root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N','N' FROM dual WHERE @current_hostname != 'localhost';
-REPLACE INTO tmp_user VALUES ('127.0.0.1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N','N');
-REPLACE INTO tmp_user VALUES ('::1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N','N');
+INSERT INTO tmp_user VALUES ('localhost','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'unix_socket','','N', 'N'); +INSERT INTO tmp_user VALUES ('localhost','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'unix_socket','','N', 'N');
REPLACE INTO tmp_user SELECT @current_hostname,'root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N','N' FROM dual WHERE @current_hostname != 'localhost'; INSERT INTO user SELECT * FROM tmp_user WHERE @had_user_table=0;
REPLACE INTO tmp_user VALUES ('127.0.0.1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N','N'); DROP TABLE tmp_user;
REPLACE INTO tmp_user VALUES ('::1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'','','N','N');
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment