[35612] in bugtraq
BENCHMARK() is not the only way to determine successfull MySQL injection
daemon@ATHENA.MIT.EDU (Philip Stoev)
Tue Jul 6 17:29:40 2004
Message-ID: <001b01c46342$46717ad0$0100a8c0@tamara>
From: "Philip Stoev" <philip@stoev.org>
To: "NGSSoftware Insight Security Research" <nisr@nextgenss.com>,
<bugtraq@securityfocus.com>, <vulnwatch@vulnwatch.org>
Date: Tue, 6 Jul 2004 13:16:15 +0300
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Hello,
As far as the timing attack using BENCHMARK() is concerned, the same effect
can be achieved as follows:
1. Inject GET_LOCK(1, 60);
(this injection will return immediately regardless of success)
2. Inject GET_LOCK(1, 5);
(if successfull, this injection will return in 5 seconds rather than
immediately)
This method provides exact delays independent of CPU speed, does not load
the processor and does not require selecting an appropriate expression to
BENCHMARK().
Philip Stoev
> Whitepaper
> **********
>
> We have written a paper that accompanies this advisory. The paper
> provides details of various MySQL lockdown techniques, and a review of
> common attacks on MySQL, including SQL injection. The paper can be found
> at
>
> http://www.ngssoftware.com/papers/HackproofingMySQL.pdf
----------------------------------------
My Inbox is protected by SPAMfighter
14126 spam mails have been blocked so far.
Download free www.spamfighter.com today!
