Debian
mysql-dfsg-5.0 package

SQL injection when selecting password for the first time.

Bug #260361 reported by Adrian Harabulă on 2008-08-22

272

This bug affects 4 people

Affects		Status	Importance	Assigned to	Milestone
	mysql-dfsg (Ubuntu)	Fix Released	Low	Unassigned
	mysql-dfsg-5.0 (Debian)	New	Unknown	debbugs #510876

Bug Description

When i'm installing mysql-server with apt-get install mysql-server , everything is OK until i get a blue screen when I have to set my password.

If i put a password with " then I get this on terminal:

* Stopping MySQL database server mysqld [ OK ]
ERROR: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ziah0") WHERE user='root'' at line 1
080822 14:59:05 [ERROR] Aborting

080822 14:59:05 [Note] /usr/sbin/mysqld: Shutdown complete

Reloading AppArmor profiles : done.
* Starting MySQL database server mysqld [ OK ]
* Checking for corrupt, not cleanly closed and upgrade needing tables.

Thanks.

Bug Watch Updater (bug-watch-updater) on 2009-03-10

Changed in mysql-dfsg-5.0:
status:	Unknown → New

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2009-04-27:

This is confirmed in jaunty. Setting as low importance, as you're already root when this happens.

Changed in mysql-dfsg (Ubuntu):
importance:	Undecided → Low
status:	New → Confirmed

Revision history for this message

bdeetz (bdeetz) wrote on 2012-03-29:

@Marc I understand that the fact that it's a point for SQL injection isn't too much of an issue since we're already root at this point, but the fact that it fails to set one's password is less than desirable. Sure, I can go set my password in the console after the setup is complete, but why should the installer even prompt me to setup a password if I can't use a decent password?

I've been witnessing this bug for years and I'm surprised there aren't more people discussing it. As such, I'm willing to take it on. This should just be a matter of character escaping. Here's to hoping I have a patch in a little while.

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2012-03-29:

Great! Please subscribe ubuntu-sponsors once you attach a patch and someone will process it. Thanks!

piotr zimoch (ebytyes) on 2013-06-14

Changed in mysql-dfsg (Ubuntu):
status:	Confirmed → New
status:	New → Incomplete
status:	Incomplete → Opinion
status:	Opinion → Invalid
status:	Invalid → Confirmed
status:	Confirmed → In Progress
status:	In Progress → Fix Committed
status:	Fix Committed → Fix Released