Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 501904 (CVE-2014-2029) - <dev-db/percona-toolkit-2.2.6 / <dev-db/xtrabackup-bin-2.1.7: remote code execution (CVE-2014-2029)
Summary: <dev-db/percona-toolkit-2.2.6 / <dev-db/xtrabackup-bin-2.1.7: remote code exe...
Alias: CVE-2014-2029
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
Whiteboard: ~2 [noglsa]
Depends on:
Reported: 2014-02-20 15:58 UTC by Agostino Sarubbo
Modified: 2014-03-05 06:01 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-02-20 15:58:35 UTC
From ${URL} :

Quoting launchpad we have this gem:
Percona Toolkit 2.1 introduced --version-check to warn user about
known vulnerabilities in the local MySQL instance and to check for PT
updates. When this option is enabled - and it is enabled by default(!) -
various information about local MySQL as well as other system binaries and
packages are submitted to Percona along with the server's IP address. This
not only exposes possibly sensitive information, but also does so without
bringing it to user's attention or asking for their consent.

It gets worse. The configuration for what information PT tools should
collect is not hardcoded in the scripts. Instead, every time it's
downloaded from One of the possible parameters
is a binary file name to be executed, i.e. Percona can remotely execute
arbitrary command - again, without making user aware of what or when
is being executed. To be fair, the ability to run commands is limited
to running "command -v", however that's only under the assumption that
the command filters will always work. The configuration can also ask
for any MySQL variable - not just the version string.

In my opinion --version-check should never be enabled by default and
if user wants to keep it enabled, the configuration (i.e. the list of
checks) should be hardcoded and explicitly listed, and not downloaded
from a remote location.

Current workaround: To avoid confidential information being exposed,
always use --no-version-check with every PT tool that includes
'version-check' feature (e.g. pt-query-digest, pt-diskstats).

Basically it is not just information leakage, but remote code execution if
you can overtake the host or just be man in the middle.

@maintainer(s): since the package has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.
Comment 1 Christian Ruppert (idl0r) gentoo-dev 2014-02-21 21:11:34 UTC
innobackupex from dev-db/xtrabackup-bin-2.1.x is also affected.

Both have been bumped/fixed.

Fixed: >=dev-db/xtrabackup-bin-2.1.7 and >=dev-db/percona-toolkit-2.2.6
Comment 2 Agostino Sarubbo gentoo-dev 2014-02-23 14:04:21 UTC
Please remove the affected version for dev-db/xtrabackup-bin
Comment 3 Christian Ruppert (idl0r) gentoo-dev 2014-02-24 19:02:43 UTC
(In reply to Agostino Sarubbo from comment #2)
> Please remove the affected version for dev-db/xtrabackup-bin

Already done.
Comment 4 Christian Ruppert (idl0r) gentoo-dev 2014-02-28 20:58:35 UTC
dev-db/xtrabackup-bin-2.0.8 is not affected.
Comment 5 Sergey Popov gentoo-dev 2014-03-05 06:01:52 UTC
(In reply to Christian Ruppert (idl0r) from comment #4)
> dev-db/xtrabackup-bin-2.0.8 is not affected.

Ok, closing as noglsa