[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#8427: [SECURITY] sql.el -- comint process passwords are leaked to ps
From: |
Glenn Morris |
Subject: |
bug#8427: [SECURITY] sql.el -- comint process passwords are leaked to ps(1) listing |
Date: |
Wed, 05 Mar 2014 21:06:16 -0500 |
User-agent: |
Gnus (www.gnus.org), GNU Emacs (www.gnu.org/software/emacs/) |
Jari Aalto wrote:
> There is a big security problem with sql.el:
>
> M-x sql-mysql
> <Fill in the connection details: user, password ...>
>
> At command line, anyone in multi-user environment can dig out the
> passwords:
>
> $ ps -ef -o user,pid,args | grep mysql # ps(1) under SUN/Solaris
> foo 9599 /usr/local/bin/mysql --user=foo --password=123456
> --host=db.example.com
> bar 3732 /usr/local/bin/mysql --user=bar --password=abcdef
> --host=db.example.com
Apparently, no they cannot, since mysql replaces the password characters
with x's:
http://www.lenzg.net/archives/256-basic-mysql-security-providing-passwords-on-the-command-line.html
I tested it and it is so hidden for me.
Also, with recent Linux kernels, you can enable the procfs "hidepid"
feature to prevent this entire class of information leakage.
So I don't think Emacs needs to do anything but maybe add a warning
statement to the doc string.
Downgrading bug severity accordingly.
- bug#8427: [SECURITY] sql.el -- comint process passwords are leaked to ps(1) listing,
Glenn Morris <=