MySQL remote exploit



crackp0t said:
It's not public. That's the fun part.
Click to expand...

Have you seen exploit code or have you heard of servers being hit?

Explain to me 'cos I'm slow but what does this give access to, the full MySQL database, some databases or shell access on the server?
 
harrymouni said:
Have you seen exploit code or have you heard of servers being hit?

Explain to me 'cos I'm slow but what does this give access to, the full MySQL database, some databases or shell access on the server?
Click to expand...

Shell access as the mysql user. Then use a local exploit to pop a root shell if that's your thing. If you're after the data you'll have access to everything. This is a pretty big deal I can't believe it's not getting more attention.
 
crackp0t said:
Shell access as the mysql user. Then use a local exploit to pop a root shell if that's your thing. If you're after the data you'll have access to everything. This is a pretty big deal I can't believe it's not getting more attention.
Click to expand...

:eek:

You're right, there's very little info on Google.
 
Seems like some old versions of MySQL. The 5.1 series is at version 5.1.61 or something and the 5.5 series is at 5.5.21 or something. Everything listed there has been outdated for a while. Upgrade your packages.
 
Exploit - "Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: vuldb@securityfocus.com."

Solution - "Vendor updates are available. Please contact the vendor for more information."

THANKS FOR THE INFO BRAH ಠ_ಠ
 
sumohax0r said:
Exploit - "Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: vuldb@securityfocus.com."

Solution - "Vendor updates are available. Please contact the vendor for more information."

THANKS FOR THE INFO BRAH ಠ_ಠ
Click to expand...

Not really sure if you're being a smart ass or not, but security focus is the last to know anything. It's like the nerd in high school that knows about all the parties after they happen. I got 0days in safari that they don't know about either.
 
cheshire said:
Seems like some old versions of MySQL. The 5.1 series is at version 5.1.61 or something and the 5.5 series is at 5.5.21 or something. Everything listed there has been outdated for a while. Upgrade your packages.
Click to expand...

While that's true a lot of repos still push old shit.
 
You must log in or register to reply here.
Top Bottom