[MDEV-9081] Debian: insecure debian-sys-maint password handling Created: 2015-11-04 Updated: 2015-12-22 Resolved: 2015-12-22 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Packaging, Platform Debian |
| Affects Version/s: | 5.5, 10.0, 10.1 |
| Fix Version/s: | 10.1.10 |
| Type: | Bug | Priority: | Major |
| Reporter: | Sergey Vojtovich | Assignee: | Sergey Vojtovich |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Issue Links: |
|
||||||||||||
| Sprint: | 10.1.10 | ||||||||||||
| Description |
|
There's this code in debian/mariadb-server-10.1.postinst script:
On initial installation it creates world-readable /etc/mysql/debian.cnf, writes a password and then revokes privileges. This makes little theoretical gap when attacker may intercept debian-sys-maint password. Also password goes via a number of echo calls. It might be alright since echo is bash builtin. But echo has rather poor reputation as a tool for handling passwords. In addition to that REPLACE statement against mysqld --bootstrap is used to update password:
|
| Comments |
| Comment by Sergey Vojtovich [ 2015-12-21 ] |
|
serg, please review fix for this bug. |
| Comment by Otto Kekäläinen [ 2015-12-22 ] |
|
This bug was also reported and fixed in Debian a long time ago. Fix was done using umask: https://github.com/ottok/mariadb-10.0/blob/master/debian/mariadb-server-10.0.postinst#L130 I see the code has umasks twice, I am not sure why, but nevertheless I thought I'd mention this. |
| Comment by Sergey Vojtovich [ 2015-12-22 ] |
|
serg, I merged fix from Otto's tree to 10.1. Could you confirm it is fine with you? |
| Comment by Sergei Golubchik [ 2015-12-22 ] |
|
ok to push |