STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

The MySQL Database Server 8.0 must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

DISA Rule

SV-235181r638812_rule

Vulnerability Number

V-235181

Group Title

SRG-APP-000340-DB-000304

Rule Version

MYS8-00-010700

Severity

CAT II

CCI(s)

• CCI-002235 - The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Weight

10

Fix Recommendation

Remove any procedures that are not authorized.

Drop the procedure or function using
DROP PROCEDURE <proc_name>;
DROP FUNCTION <function_name>;

Check Contents

Review the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes.

SHOW PROCEDURE STATUS where security_type <> 'INVOKER';
SHOW FUNCTION STATUS where security_type <> 'INVOKER';

If DEFINER accounts are returned that are not documented and authorized, this is a finding.
If elevation of MySQL privileges using DEFINER is documented, but not implemented as described in the documentation, this is a finding.
If the privilege-elevation logic can be invoked in ways other than intended, or in contexts other than intended, or by subjects/principals other than intended, this is a finding.

Vulnerability Number

V-235181

Documentable

False

Rule Version

MYS8-00-010700

Severity Override Guidance

Review the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes.

SHOW PROCEDURE STATUS where security_type <> 'INVOKER';
SHOW FUNCTION STATUS where security_type <> 'INVOKER';

If DEFINER accounts are returned that are not documented and authorized, this is a finding.
If elevation of MySQL privileges using DEFINER is documented, but not implemented as described in the documentation, this is a finding.
If the privilege-elevation logic can be invoked in ways other than intended, or in contexts other than intended, or by subjects/principals other than intended, this is a finding.

Check Content Reference

M

Target Key

5277

Comments