荣耀彩票代理

IT技术互动交流平台

流氓MySQL利用服务器非法盗取秘密文件

作者:wy  来源:网络整理  发布日期:2019-01-28 08:37:00
   大家一定要小心警惕的看待MySQL这个标签和它整个的应用,因为它最近又出现问题了在网络界里面它被业界人士称为流氓,如果你不知道它为何有这个称呼那么请你一定要认真看这篇文章了,因为它利用服务器非法盗取秘密文件。

   客户端主机和MySQL服务器之间的文件传输交互中的设计缺陷允许运行恶意MySQL服务器的攻击者访问连接的客户端具有读取访问权限的任何数据。

荣耀彩票代理  BUFAFENZIKEYILIYONGCIWENTICONGPEIZHIBUDANGDEwebFUWUQI(YUNXULIANJIEDAOBUSHOUXINRENDEFUWUQI)HUOSHUJUKUGUANLIYINGYONGCHENGXUJIANSUOMINGANXINXI。

  ANQUANWENTIGENYUAN

荣耀彩票代理  WENTICHUZAIYUBENDIXIUSHIFUYIQISHIYONGDELOAD DATAYUJUSHANG,GAIYUJUZAIMySQLWENDANGZHONGBEIYINYONGWEIANQUANFENGXIAN。

  KAIFARENYUANDUICIDEJIESHISHI,KEHUDUANGENJUKEHUDUANZAILOAD DATAYUJUZHONGTIGONGDEXINXICONGMySQLFUWUQIJIESHOUWENJIANCHUANSHUQINGQIU。DANSHI,EYIFUWUQIKEYISHIYONGLOAD DATA LOCALYUJUJINXINGHUIFU,BINGYAOQIUKEHUDUANJUYOURENHEWENJIANDEQUANXIAN。

荣耀彩票代理  DABUDINGDEFUWUQISHIJISHANGKEYIYONGWENJIANCHUANSHUQINGQIUDUIRENHEYUJUJINXINGXIANGYING,ERBUJINJINSHIJIAZAIBENDISHUJU,YINCIGENGGENBENDEWENTISHIKEHUDUANBUYINGGAILIANJIEDAOBUSHOUXINRENDEFUWUQI,ZHEITONGYANGSHIYONGYUwebFUWUQI,TAMENZAILIANJIEDAOMySQLFUWUQISHICHONGDANGKEHUDUAN。ZAIZHEIZHONGQINGKUANGXIA,GONGJIZHEKEYISHIYONGGAIQUEXIANQIEQU/etc/passwdWENJIAN,ERZHEIXIEWENJIANBAOHANYONGHUZHANGHUJILU。

  ZHIYOUDANGFUWUQIZHIDAOWENJIANDEWANZHENGLUJINGSHI,CAINENGTONGGUOZHEIZHONGFANGSHIHUOQUWENJIAN。DANSHI,CAOZUOZHEHAIKEYITONGGUOQINGQIU“/proc/self/ environmenton”WENJIANLAILEJIEZHEILUJING,GAIWENJIANTIGONGYUNXINGJINCHENGDEHUANJINGBIANLIANG,CONGERGONGKAIZHUMULUHEGUANYUNEIBUWENJIANJIAJIEGOUDEXIANGXIXINXI。

  SUISHIKEYONGDELIUMANGMySQLFUWUQI

文件

  ANQUANYANJIUYUANWillem de Groot 1YUE20RIZAIRedditSHANGFAQILEYICHANGTAOLUN,YINFALEZHUDUOYILUN,TAOLUNZHEGOUSILEEYIMySQLFUWUQIDEKENENGFAHUIZUOYONGDECHANGJING,RUQIEQUSSHMIYAOHEJIAMIHUOBIQIANBAODEFANGWENXIJIE。

荣耀彩票代理  GENJUde GrootDESHUOFA,2018NIAN10YUEDEMagecartGONGJILIYONGMySQLLOUDONGXIANGGOUWUWANGZHANZHURUDAIMA,QIEQUJIEZHANGSHIDEYINXINGKAXINXI。GUOQUWUNIAN,GitHubSHANGYIJINGCHUXIANLEZHENDUILIUMANGMySQLFUWUQIDEDAIMA,YINCI,RUGUOWANGLUOFANZUIFENZIZAIGONGJIZHONGSHIYONGLETA,YEJIUBUZUWEIQI。

  ZAISHANGZHOUDEBOKEWENZHANGZHONG,de GrootJIESHILEPIANZIMENSHIRUHELIYONGZHEIGELOUDONGZAIAdminer(YIGEGUANLIPostgreSQLHEMySQLSHUJUKUDEGONGJU)DEBANGZHUXIATIQUMINGANXIJIEDE。GONGJIZHEDEMUDESIHUSHIDAOQUMagentoSHANGYEPINGTAICUNCHUSHUJUKUMIMADEWENJIAN(“local.xml”)。

  ZHEIZAIYUNXINGYIGEYISHOUGONGJIDEAdminerBANBENDEWANGZHANSHANGSHIKENENGDE(BANBEN4.3.1DAO4.6.2BEIFAXIANSHOUDAOLEZHEIGEbugDEYINGXIANG)。GUANLIYUANYINGGAIZHUANXIANGGENGANQUANDEBANBEN,BANBENZUIHAOBUDIYU4.6.3。

荣耀彩票代理  RUGUOXIAOHUOBANMENYUDAOLELEISIDEWENTIQINGYIDINGYAOZHUAZHUZHEIGEJIYUJIANGWOMENWENZHANGLISUOTUIJIANDERUANJIANHECHANPINYIYIDOUSHIYIBIAN,RUGUONIHAIHENGANXINGQUDEHUAQINGYIDINGYAORENZHENYUEDUBENPIANWENZHANGYINWEITAKENENGJINIDAILAIWUQIONGWUJINDEZHISHI。

延伸阅读:

Tag标签:         
  • 专题推荐

About IT165 - 广告服务 - 隐私声明 - 版权申明 - 免责条款 - 网站地图 - 网友投稿 - 联系方式
本站内容来自于互联网,仅供用于网络技术学习,学习中请遵循相关法律法规