mysql身份认证漏洞_.MySQL身份认证漏洞详解

该楼层疑似违规已被系统折叠 隐藏此楼查看此楼

漏洞分析：

问题代码：

my_bool check_scramble(const uchar *scramble_arg, const char

*message,

const uint8 *hash_stage2)

{

SHA1_CONTEXT

sha1_context;

uint8 buf[SHA1_HASH_SIZE];

uint8

hash_stage2_reassured[SHA1_HASH_SIZE];

mysql_sha1_reset(&sha1_context);

/* create key to encrypt scramble */

mysql_sha1_input(&sha1_context, (const uint8 *) message,

SCRAMBLE_LENGTH);

mysql_sha1_input(&sha1_context, hash_stage2,

SHA1_HASH_SIZE);

mysql_sha1_result(&sha1_context, buf);

/* encrypt

scramble */ my_crypt((char *) buf, buf, scramble_arg, SCRAMBLE_LENGTH);

/*

now buf supposedly contains hash_stage1: so we can get hash_stage2 */

mysql_sha1_reset(&sha1_context);

mysql_sha1_input(&sha1_context,

buf, SHA1_HASH_SIZE);

mysql_sha1_result(&sha1_context,

hash_stage2_reassured);

return memcmp(hash_stage2, hash_stage2_reassured,

SHA1_HASH_SIZE);

}

memcmp的返回值实际上是int，而my_bool实际上是char。那么在把int转换成char的时候，就有可能发生截断。比如，memcmp返回0×200，截断后变成了0，调用check_scramble函数的就误以为“password

is correct“。