BugTraq
Re: [oss-security] Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday Dec 02 2012 08:24PM
Yves-Alexis Perez (corsac debian org) (1 replies)
Re: [oss-security] Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday Dec 02 2012 08:36PM
king cope (isowarez isowarez isowarez googlemail com)
Correct, I tell that from experience because I've seen many
configurations where the least privileged user has file privs enabled.
If we leave it that way the attackers will be more happy, it's not
decision to patch it or not, just a hint .

Regard,

Kingcope

2012/12/2 Yves-Alexis Perez <corsac (at) debian (dot) org [email concealed]>:
> On dim., 2012-12-02 at 21:17 +0100, king cope wrote:
>> My opinion is that the FILE to admin privilege elevation should be patched.
>> What is the reason to have FILE and ADMIN privileges seperated when
>> with this exploit
>> FILE privileges equate to ALL ADMIN privileges.
>
> Maybe because you might not want admins to have read/write access to the
> filesystem anyway?
>
> Regards,
> --
> Yves-Alexis

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus