Bug #72346 [NEW]: mysql_query() not subject to max_execution_time()
From: maggus dot staab at googlemail dot com
Operating system:
PHP version: Irrelevant
Package: *General Issues
Bug Type: Bug
Bug description:mysql_query() not subject to max_execution_time()
Description:
------------
similar to https://bugs.php.net/bug.php?id=72345
A DOS attack vector for SQL injections uses the mysql SELECT SLEEP()
command, as it will block a PHP process which is waiting for the mysql
result and also one connection to the database itself.
this renders this kind of attack as very effective because you easily
can bring either apache/php or mysql above its processlimits.
Additionally the mysql version distributed with ubuntu12lts and
ubuntu14lts is not recent enough to contain server side timouts on a per
statement basis.
Test script:
---------------
<?php
$start = time();
set_time_limit(2);
define("DB_HOSTNAME", "localhost");
define("DB_USERNAME", "root");
define("DB_PASSWORD", "");
define("DB_NAME", "mysql");
$connection_id = mysql_connect(DB_HOSTNAME, DB_USERNAME, DB_PASSWORD,
false);
mysql_query('SELECT SLEEP(5)', $connection_id);
$end = time();
echo $end - $start;
Expected result:
----------------
mysql query should be interrupted after 2 seconds with a fatal error
Actual result:
--------------
no error, no timeouts triggered.
echos "5"
--
Edit bug report at https://bugs.php.net/bug.php?id=72346&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72346&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72346&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72346&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=72346&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=72346&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=72346&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=72346&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=72346&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=72346&r=support
Expected behavior: https://bugs.php.net/fix.php?id=72346&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=72346&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=72346&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=72346&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72346&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=72346&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=72346&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=72346&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=72346&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=72346&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=72346&r=mysqlcfg
Thread (4 messages)
- maggus dot staab at googlemail dot com