473,323 Members | 1,622 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,323 software developers and data experts.

non close-on-exec mysql connection descriptor leads to security risks

Hi all,
http://bugs.mysql.com/bug.php?id=3779
Discussion about insecurity of mysql_pconnect in
multi-server/multi-user environment.Can anyone explain what Hartmut
Holzgraefe meant by

"But even if close_on_exec were set on PHP->MySQL connections there
would still be the risk of connection hijacking with PHP pconnect
as any other piece of code executed within the web server context
has access to the persistant connection. This especially includes,
but is not limited to, other PHP scripts. " ???

How is is possible to hijack a mysql connection in a php script?

Thanks,
Lukasz Wojtow
Jul 17 '05 #1
1 2218
"Luke Wojtow" <gn*@student.wszia.edu.pl> wrote in message
news:2f**************************@posting.google.c om...
Hi all,
http://bugs.mysql.com/bug.php?id=3779
Discussion about insecurity of mysql_pconnect in
multi-server/multi-user environment.Can anyone explain what Hartmut
Holzgraefe meant by

"But even if close_on_exec were set on PHP->MySQL connections there
would still be the risk of connection hijacking with PHP pconnect
as any other piece of code executed within the web server context
has access to the persistant connection. This especially includes,
but is not limited to, other PHP scripts. " ???

How is is possible to hijack a mysql connection in a php script?

I don't see how. The MySQL library doesn't provide a way to convert a file
descriptor (as a number) into a DB connection. There are no functions that I
know of that convert the file descriptor into a socket resource either.
Might be possible to create a raw socket, put together the TCP/IP datagrams
using PHP, then send them to MySQL.
Jul 17 '05 #2

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

1
by: CST | last post by:
Hi All, I looked through numerous posts and couldn't find exactly what I am looking for, so I am posting this. We have a web application that runs reports. A user needs to run multiple reports...
4
by: moose | last post by:
OK Popup window? No problem PDF in popup? No problem But what about a couple of Close Window buttons? Imagine a "Close Window" button at the top of the popup page. Then the PDF which can...
6
by: marcelf3 | last post by:
Hello.. This page opens a window with some information, but everytime the user changes a field in the parent window, the child window needs to be closed. These 2 functions were supposed to do the...
19
by: Lauren Wilson | last post by:
A2K app: Question: is the flagged line (<<<) below necessary. If that line is needed, what effect does it have (if any) on the fact that the very same database is the linked back end db? ...
4
by: GrantS | last post by:
I am having a problem closing a popup window opened modally. When I try to close the window (when the user hits save button and the data has been processed), the Popup window opens as a full screen...
7
by: Nikki | last post by:
Hi, Can anybody help me, i want to prevent windows to close my winform of ..NET application, when user presses Alt+F4
6
by: cj | last post by:
What is the difference between using Me.close vs. End to stop the execution of a program? I've been using me.close and putting code in the form.closing event to make sure things are stopped...
1
by: Sorin Schwimmer | last post by:
Hi, I tried for the first time a Tix Tree, so, if my question is naive, I apologize upfront. The following code: <code> from Tix import * r=Tk()
1
by: OxfordConsult | last post by:
I have a form and it is to creat a 'link' between a project and a company. Creating a record form this table will simply create a record in a databse with the company ID and project ID. Project ID is...
6
by: =?Utf-8?B?UGF1bA==?= | last post by:
I am looking for a java script to close a web form that I can attatch to a button click event. I am using vs2005, c#. Thanks -- Paul G Software engineer.
0
by: DolphinDB | last post by:
Tired of spending countless mintues downsampling your data? Look no further! In this article, you’ll learn how to efficiently downsample 6.48 billion high-frequency records to 61 million...
0
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
1
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
0
by: Vimpel783 | last post by:
Hello! Guys, I found this code on the Internet, but I need to modify it a little. It works well, the problem is this: Data is sent from only one cell, in this case B5, but it is necessary that data...
1
by: PapaRatzi | last post by:
Hello, I am teaching myself MS Access forms design and Visual Basic. I've created a table to capture a list of Top 30 singles and forms to capture new entries. The final step is a form (unbound)...
1
by: Defcon1945 | last post by:
I'm trying to learn Python using Pycharm but import shutil doesn't work
1
by: Shællîpôpï 09 | last post by:
If u are using a keypad phone, how do u turn on JavaScript, to access features like WhatsApp, Facebook, Instagram....
0
by: af34tf | last post by:
Hi Guys, I have a domain whose name is BytesLimited.com, and I want to sell it. Does anyone know about platforms that allow me to list my domain in auction for free. Thank you
0
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 3 Apr 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome former...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.