Comment 2 for bug 1289599

Revision history for this message
Valerii Kravchuk (valerii-kravchuk) wrote : Re: Authentication bypass

Seems easy to confirm:

[openxs@centos ~]$ mysql -uroot test
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.6.15-56 Percona Server (GPL), Release rel63.0, Revision 519

Copyright (c) 2009-2013 Percona LLC and/or its affiliates
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> select user, host from mysql.user;
+------+-----------+
| user | host |
+------+-----------+
| root | 127.0.0.1 |
| root | ::1 |
| | centos |
| root | centos |
| | localhost |
| root | localhost |
+------+-----------+
6 rows in set (0.03 sec)

mysql> install plugin auth_socket soname "auth_socket.so";
Query OK, 0 rows affected (0.11 sec)

mysql> drop user 'root'@'::1';
Query OK, 0 rows affected (0.02 sec)

mysql> drop user ''@'localhost';
Query OK, 0 rows affected (0.00 sec)

mysql> update mysql.user set plugin='auth_socket' where user='root';
Query OK, 3 rows affected (0.04 sec)
Rows matched: 3 Changed: 3 Warnings: 0

mysql> select user, host from mysql.user;
+------+-----------+
| user | host |
+------+-----------+
| root | 127.0.0.1 |
| | centos |
| root | centos |
| root | localhost |
+------+-----------+
4 rows in set (0.01 sec)

mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)

mysql> exit
Bye
[openxs@centos ~]$ mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 3
Server version: 5.6.15-56 Percona Server (GPL), Release rel63.0, Revision 519

Copyright (c) 2009-2013 Percona LLC and/or its affiliates
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> select user(), current_user();
+------------------+----------------+
| user() | current_user() |
+------------------+----------------+
| openxs@localhost | root@centos |
+------------------+----------------+
1 row in set (0.00 sec)

This should never happen as far as I can see from http://dev.mysql.com/doc/mysql-security-excerpt/5.5/en/socket-authentication-plugin.html