oss-security - Re: Clear text password in process list when using MySQL GUI tools

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <297054876.1296341290001086716.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Wed, 17 Nov 2010 08:38:06 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: Clear text password in process list when using
 MySQL GUI tools

Steve,

What are the thoughts of MITRE on this one? This affects all sorts of stuff,
and I don't upstream removing the command line option (which is probably the
only fix).

Thanks.

-- 
    JB


----- "Martin Drescher" <drescher@...fu.de> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi ML.
> 
> If you use some MySQL-GUI-tool in most (any?) linux distribution like
> mysql-admin or mysql-query-browser and then open 'Tools -> MySQL Text
> Console' your password, user name and host will become exposed in the
> process list.
> 
> I think this issue must exists over a long time in many distributions
> now but nobody ever cared about.
> 
> For Debian users:
> Packages mysql-query-browser, mysql-admin are affected.
> 
> 
> So far, Martin
> 
>  GnuPG Key Fingerprint, KeyID '4FBE451A':
>  '2237 1E95 8E50 E825 9FE8  AEE1 6FF4 1E34 4FBE 451A'
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAkzir8gACgkQb/QeNE++RRqfIQCfaLDToS6pAfuj4/XgkYSKnBh0
> nu8An3JJAp2nZWcOODOXX2KGs07ouATd
> =/nj6
> -----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.