I have been looking all over the web now, and can not seem to find the option to disable this command. I think this is quite a risky security hole.
There is an option to disable SHOW DATABASES; , but not SHOW TABLES;
Maybe some of you had
-
4Why on earth is it a "risky" security hole?– PhilᵀᴹCommented Jan 28, 2013 at 12:04
-
@Phil, one would see those table anyway where he has read access.– Michael-OCommented Jan 28, 2013 at 12:11
-
Well the way I think, if someone makes an SQL injection to your application, he might find entire structure of database from show tables. if he just makes injection, he will still need to guess table names.– KatafalkasCommented Jan 28, 2013 at 13:31
-
or am I just nuts ? :)– KatafalkasCommented Jan 28, 2013 at 13:32
-
Maybe just adjust the permissions of the application user that queries the database? And let it just read/write to the correct tables and revoke any unneeded permissions. It's just a thought, I'm not very familiar with MySQL security concepts, but shouldn't be too different from other RDBMSs..– MarianCommented Jan 28, 2013 at 13:51
|
Show 1 more comment
1 Answer
As far as I know you cannot disable SHOW TABLES, but if you have only assigned permissions to tables that the user should be able to access, I don't see how there is a security issue. A user cannot list tables to which he has no permissions.
root@beren [~]# mysql -u root -p
Enter password:
<-- SNIP -->
mysql> use foo;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> show tables;
+---------------+
| Tables_in_foo |
+---------------+
| bar |
| baz |
+---------------+
2 rows in set (0.00 sec)
mysql> create user 'quux'@'localhost' identified by '*******';
Query OK, 0 rows affected (0.00 sec)
mysql> grant select on table foo.bar to 'quux'@'localhost';
Query OK, 0 rows affected (0.00 sec)
mysql> flush privileges;
Query OK, 0 rows affected (0.02 sec)
mysql> exit
Bye
root@beren [~]# mysql -u quux -p foo
Enter password:
<-- SNIP -->
mysql> show tables;
+---------------+
| Tables_in_foo |
+---------------+
| bar |
+---------------+
1 row in set (0.00 sec)
mysql>
