Bug#11746817:MYSQL_INSTALL_DB CREATES WILDCARD GRANTS WHEN

HOST HAS '_' IN THE HOSTNAME

Problem:
=======
'_' and '%' are treated as a wildcards by the ACL code and
this is documented in the manual. The problem with
mysql_install_db is that it does not take this into account
when creating the initial GRANT tables:

--- cut ---
REPLACE INTO tmp_user SELECT @current_hostname,'root','','Y',
'Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y',
'Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',
0,0,0,0 FROM dual WHERE LOWER( @current_hostname) != 'localhost';
--- cut ---

If @current_hostname contains any wildcard characters, then 
a wildcard entry will be defined for the 'root' user, 
which is a flaw.

Analysis:
========
As per the bug description when we have a hostname with a
wildcard character in it, it allows clients from several other
hosts with similar name pattern to connect to the server as root.
For example, if the hostname is like 'host_.com' then the same
name is logged in mysql.user table. This allows 'root' users
from other hosts like 'host1.com', 'host2.com' ... to connect
to the server as root user.

While creating the intial GRANT tables we do not have a check
for wildcard characters in hostname.

Fix:
===
As part of fix escape character "\" is added before wildcard
character to make it a plain character, so that the one and
only host with the exact name will be able to connect to the
server.

scripts/mysql_system_tables_data.sql:
  while creating default users get the hostname and
  replace the wildcard characters within the hostname after
  escaping them.

1 files changed, 9 insertions, 5 deletions

diff --git a/scripts/mysql_system_tables_data.sql b/scripts/mysql_system_tables_data.sql
index e82d5412d75..7203e250656 100644
--- a/scripts/mysql_system_tables_data.sql
+++ b/scripts/mysql_system_tables_data.sql
@@ -1,4 +1,4 @@
--- Copyright (c) 2007 MySQL AB, 2008 Sun Microsystems, Inc.
+-- Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
 -- Use is subject to license terms.
 -- 
 -- This program is free software; you can redistribute it and/or modify
@@ -21,7 +21,12 @@
 -- When setting up a "cross bootstrap" database (e.g., creating data on a Unix
 -- host which will later be included in a Windows zip file), any lines
 -- containing "@current_hostname" are filtered out by mysql_install_db.
-set @current_hostname= @@hostname;
+
+-- Get the hostname, if the hostname has any wildcard character like "_" or "%" 
+-- add escape character in front of wildcard character to convert "_" or "%" to
+-- a plain character
+SET @get_hostname= @@hostname;
+SELECT REPLACE((SELECT REPLACE(@get_hostname,'_','\_')),'%','\%') INTO @current_hostname;
 
 
 -- Fill "db" table with default grants for anyone to
@@ -33,10 +38,9 @@ INSERT INTO db SELECT * FROM tmp_db WHERE @had_db_table=0;
 DROP TABLE tmp_db;
 
 
--- Fill "users" table with default users allowing root access
--- from local machine if "users" table didn't exist before
+-- Fill "user" table with default users allowing root access
+-- from local machine if "user" table didn't exist before
 CREATE TEMPORARY TABLE tmp_user LIKE user;
-set @current_hostname= @@hostname;
 INSERT INTO tmp_user VALUES ('localhost','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0);
 REPLACE INTO tmp_user SELECT @current_hostname,'root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0 FROM dual WHERE LOWER( @current_hostname) != 'localhost';
 REPLACE INTO tmp_user VALUES ('127.0.0.1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0);