Re: Chained command prints password in Clear Text and breaks BASH Session until logout

[Jason Sipula]

I probably should have filed two different reports for this. Sorry for any
confusion guys.

The password makes sense to me why it allows clear text...

The second issue is once the command terminates, bash session does not
behave normally at all. Nothing typed into the terminal over SSH or
directly on the console displays, however it does receive the keys. Also,
if you repeatedly hit ENTER key, instead of skipping to new line, it just
repeats the bash prompt over and over in a single line. So far restarting
bash session (by logging out then back in) is the only way I have found to
"fix" the session and return to normal functionality.


On Thu, Jul 11, 2013 at 10:47 AM, John Kearney <dethrophes@web.de> wrote:

>
> This isn't a but in bash.
> firstly once a program is started it takes over the input so the fact that
> your password is echoed to the terminal is because myspl allows it not
> bash, and in mysql defense this is the normal behaviour for command line
> tools.
>
> Secondly both mysqldump  and mysql start at the same time and can
> potentially be reading the password also at the same time.
> on some systems and for some apps it could happen that.
>
> password for mysqldump p1234
> password for mysql          p5678
>
> the way you are staring them you could potentially end up with
>
> mysqldump getting p5274
> mysql getting  p1638
>
> basically you should give the password on the command line to mysql.
>
> something like
> read -sp "Password:" Password
> mysqldump -u someuser --password ${Password} -p somedb | mysql -u someuser
> --password ${Password} -p -D someotherdb
>
>  *Gesendet:* Mittwoch, 10. Juli 2013 um 23:54 Uhr
> *Von:* "Jason Sipula" <alupis1@gmail.com>
> *An:* bug-bash@gnu.org
> *Betreff:* Chained command prints password in Clear Text and breaks BASH
> Session until logout
> Configuration Information [Automatically generated, do not change]:
> Machine: x86_64
> OS: linux-gnu
> Compiler: gcc
> Compilation CFLAGS: -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64'
> -DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-redhat-linux-gnu'
> -DCONF_VENDOR='redhat' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash'
> -DSHELL -DHAVE_CONFIG_H -I. -I. -I./include -I./lib -D_GNU_SOURCE
> -DRECYCLES_PIDS -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
> -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -fwrapv
> uname output: Linux appsrv01.js.local 2.6.32-358.6.1.el6.x86_64 #1 SMP Tue
> Apr 23 19:29:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
> Machine Type: x86_64-redhat-linux-gnu
>
> Bash Version: 4.1
> Patch Level: 2
> Release Status: release
>
> Description:
>
> Reproducible from both an SSH session as well as directly at the console.
>
> On BASH 4.1.x (4.1.2) running under CentOS 6.x (6.4 Final) and MySQL 5.1.x
> (5.1.69). I believe this bug will persist on all distros running BASH 4.x.x
>
> After running the chained command (see below "Repeat-By" section), BASH
> allows a password field to be seen in Clear Text, and then the BASH session
> breaks until BASH session is restarted (logout then login).
>
> The purpose of the command is to dump the database "somedb" ... which would
> normally dump to a text file for import later... but instead redirect
> stdout to the stdin of the chained mysql command which will import all the
> data from "somedb" into "someotherdb" on the same MySQL host. The command
> works, but there's two problems.
>
> MySQL correctly challenges for password of "someuser" to perform the
> mysqldump part, but once you type in the password and hit ENTER, it skips
> to a new blank line without the shell prompt and just sits. It is waiting
> for you to type in the password for "someuser" as the second part of the
> command (but does not prompt for this and it's not intuitive, it appears
> as-if the command is running)... If you type, it's in clear text!
> Potentially a major security issue there.
>
> It gets worse...
>
> After you hit ENTER a second time, the command will finish, and it will
> return a fresh line with the shell prompt. Everything looks normal... but
> try typing. Nothing will show at all, however it is sending the keys to the
> shell and will execute commands if you type them in and hit ENTER. Each
> successful command will return you to a fresh shell line, but same thing
> happens until you log out and back in (to restart BASH). Also, while this
> is happening, you can hit the ENTER key over and over and BASH will just
> keep repeating the shell prompt on the same line.
>
> Repeat-By:
>
> At the shell, issue the command:
>
> ~]# mysqldump -u someuser -p somedb | mysql -u someuser -p -D someotherdb
>
> Shouldn't need to run that command as root, but the mysql user must be
> privileged enough to work with the two databases. To simplify things you
> can replace "someuser" with root.
>
> Thank you,
>
> Jason Sipula
> alupis1@gmail.com
>