Re: load data local ... security issue

[Michael Widenius]

Hi!

>>>>> "Sinisa" == Sinisa Milivojevic <sinisa@stripped> writes:

Sinisa> On Wed, 06 Feb 2002 12:39:03 +0200
Sinisa> Alexander Keremidarski <salle@stripped> wrote:

>> LOAD DATA LOCAL INFILE ''

<cut>

Sinisa> Yes, we know about that scenario.

Sinisa> Temporary fix is that all important files should be readable by root (system
> root) only.

Sinisa> MySQL fix will be to drop LOCAL, when processing LOAD DATA, when both client
> and server are on the same computer.

No, this will not produce the desirable result.

We will instead introduce a new privilege in MySQL 4.0 that can be
used to disable LOAD DATA LOCAL...
(We will also add an option to disable this in MySQL 3.23)

Regards,
Monty