MySQL / MariaDB: Privilege Escalation / Race Condition / Root Privilege Escalation (CVE-2016-6663 and CVE-2016-6664)

Several new security vulnerabilities that affect some versions of MySQL and MariaDB were announced recently:

We want to let you know that all the published Bitnami Stacks that include MySQL or MariaDB as the database server are not affected, since they are using non-affected versions of the component.

CVE-2016-6663

The vulnerability can allow a local system user with access to the affected database in the context of a low-privileged account (CREATE/INSERT/SELECT grants) to escalate their privileges and execute arbitrary code as the database system user.

Successful exploitation would allow an attacker to gain access to all of the databases stored on the affected database server.

Affected versions:

MariaDB 

< 5.5.52

< 10.1.18

        < 10.0.28

MySQL  

<= 5.5.51

<= 5.6.32

<= 5.7.14

More information about this issue can be found at the following link: https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html

CVE-2016-6664

MySQL-based databases including MySQL, MariaDB and Percona are affected by a privilege escalation vulnerability which can let attackers who have gained access to mysql system user to further escalate their privileges to root user allowing them to fully compromise the system.

The vulnerability stems from unsafe file handling of error logs and other files.

Affected versions:

MySQL  

<= 5.5.51

<= 5.6.32

<= 5.7.14

MariaDB

All current

More information about this issue can be found at the following link: https://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html

Are you using an affected version of the server or do you have questions about the security issue? Please post to our community forum and we will be happy to help you.

MySQL Security Issue (CVE-2016-6662)

A critical vulnerability that affects all MySQL version branches was recently announced.  

Affected versions are:
MySQL <= 5.7.15
               5.6.33
               5.5.52
MySQL clones (MariaDB, PerconaDB...) are also affected.

This issue allows attackers to inject malicious settings into a MySQL configuration locally and remotely. Both the authenticated access (network connection or web interface) or SQL Injection could be used as exploitation vectors to achieve Remote Root Code Execution. For more information, visit here.

Official patches are not available yet. As temporary mitigations, users should ensure that MySQL config files are not owned by mysql user, and create root-owned dummy my.cnf files that are not in use. This is not a complete solution, we will re-check new MySQL/MariaDB versions when they are available.

We want to let you know that Bitnami Stacks (VMs, Cloud Images, Docker containers and Native Installers) are not affected since our MySQL configuration is not owned by mysql user and we explicitly define the configuration file using the parameter below for starting the service:
             --defaults-files=/opt/bitnami/mysql/my.cnf

So, the creation of any other my.cnf file will be ignored.

Do you have questions about the security issue? Post to our community forum, and we will be happy to help you.

MONyog Now Available on Bitnami

We’re pleased to welcome MONyog into the Bitnami Library! If you’re a MySQL database administrator looking for an enterprise-grade data monitoring tool that not only offers support for unlimited servers but also top-of-the-line security, test out our newest Application Server app.

MONyog also offers an array of features that ensure you’re getting the most out of your MySQL and MariaDB deployments. From real-time query monitoring analysis to advanced server metrics that alert you to resource shortages, MONyog helps you to tighten security, optimize performance and reduce downtime.

Key features included:

• Real-time query monitoring and log analysis
• Replication and deadlock monitoring
• Proactive alerts via email and SNMP
• Historical/trend analysis of performance data
• Agentless installation
• Supports MySQL servers running on any platform
• Multi-user support with per-server access rules and LDAP integration
• HTTP API for integration with third-party applications

Interested in MONyog? Deploy a one-hour free demo of the Bitnami MONyog Stack! We make it easy to run MONyog in the cloud, virtually, or locally in minutes. Try it out now!

MONyog MySQL Monitor is a product of database management software company Webyog. To learn more about MONyog, please visit the MONyog website and knowledge base.

New Nginx stack with PHP and MySQL (LEMP)

We are happy to announce that the Bitnami Nginx Stack has been released. Also known as LEMP, WEMP and MEMP for Linux, Windows and OSX respectively, it provides a ready to run environment with the Nginx Web Server, PHP and MySQL.


The stack includes the following primary components:

• Nginx Web server (1.6.1)
• MySQL database server (5.5.38)
• PHP-FPM (5.4.31)
• phpMyAdmin web application management tool for the MySQL database (4.2.7.1)

In addition to these components, it includes:

• Varnish proxy cache server (optional)
• ImageMagick tool
• SQLite database
• XDebug module
• Memcache module
• APC module
• GD library
• OpenSSL library
• CURL library
• OpenLDAP library
• PEAR and PECL package manager tools

Nginx is a small but very powerful and efficient web server and mail proxy. It is trusted but many of the busiest sites on internet, such as WordPress, Facebook and Dropbox. It is an asynchronous server and its main advantage is scalability. In a process-based server, each simultaneous connection requires a thread. This incurs significant overhead. An asynchronous server, on the other hand, is event-driven and handles requests in a single (or at least, very few) threads, consuming less RAM in busy environments.

The Bitnami Nginx Stack is also configured with PHP-FPM (FastCGI Process Manager), an alternative PHP FastCGI implementation with some additional features useful for sites of any size, especially busier sites.

The Bitnami Nginx Stack is available for free from the Bitnami app store as a native installer or virtual machine for local development, or as a cloud template for the Amazon and Windows Azure cloud computing platforms.

Once the installation process has been completed, you can access the welcome page from your browser at http://localhost on Windows or http://localhost:8080 on OS X or Linux.

We documented more details and more features of the Bitnami Nginx Stack in our Quick Start Guide. You can also check here how to install WordPress on an Nginx Cloud Image.

Do you have questions? We will be happy to help you at our community forum!

Try Bitnami Nginx Now

PHP 5.6alpha3 and MySQL 5.6 now available in Bitnami

PHP 5.6.0alpha3 was been released at the end of the last week and we are happy to announce that the Bitnami Library includes now support for this PHP version in our stacks: WAMP for Windows, MAMP for OS X and LAMP for Linux. There are also virtual machines available for download and cloud images to deploy them on Bitnami Cloud Hosting, Azure and Amazon EC2 directly.


The stacks allow you to setup instant PHP development and testing environments locally in your desktop or in the cloud. They include everything you need to start working on web applications and development frameworks. PHP 5.6 is still under testing, so there can be features that can be changed before the final 5.6.0 release.

WAMP stack installer

WAPP, MAPP and LAPP stacks are also available in case you prefer to use PostgreSQL database.

These new development stacks ship the following main components:
- PHP 5.6.0alpha3
- Apache 2.4.7
- MySQL 5.6.16 (PostgreSQL 9.3.2)
- phpMyAdmin 4.1.9

About PHP 5.6.0alpha3, the most important new features compared with the PHP 5.5 version are:

• phpdbg: PHP now includes an interactive debugger called phpdbg implemented as a SAPI module.

• Large file uploads: Files larger than 2 gigabytes in size are now accepted.

• gost-crypto hash algorithm: The gost-crypto hash algorithm has been added.

• SSL/TLS improvements: The OpenSSL extension has been extended to include support for extracting and verifying certificate fingerprints.

• Support for the Windows CA cert store for peer verification when no CA file is available

• OPCache module enabled by default

About MySQL 5.6, the most important features are:

• Performance: the optimizer has been improved, using Multi-Range Read and File Sort Optimization, as well as InnoDB (the default storage engine) to enhance performance of the MySQL database

• Scalability: as the database grows, tables can be partitioned to manage data more optimally, while keeping the convenience of a SQL interface for the full table. There are some new features that help with this.

• Replication: replication is a good feature for data integrity, availability and performance, and there are a lot of new improvements in this MySQL version which help to achieve this goal, such as replication checksums to ensure the integrity of the data being replicated to a slave.

PHP 5.6.0alpha3 info

Try it now if your application is ready to make the jump to light speed for PHP 5.6 and MySQL 5.6!

BitNami Tomcat Stack now with phpMyAdmin

We have recently released an update for the BitNami Tomcat stack which includes the latest version of Tomcat, 7.0.35. Per popular demand, we now include phpMyAdmin, the popular MySQL admin tool.

For those of you not familiar with it, BitNami Tomcat Stack simplifies the development and deployment of Java web applications. It includes ready-to-run versions of Tomcat, Apache, MySQL and all of its required dependencies. Our users have repeatedly asked us to bundle a good database management tool because it would make easier the development of Java web applications with MySQL as the database engine. We researched existing Java-based tools, but we did not find any that were comparable in quality and functionality to phpMyAdmin.

phpMyAdmin is a free software tool written in PHP, intended to handle the administration of MySQL using a web browser. phpMyAdmin supports a wide range of operations with MySQL. The most frequently used operations are supported by the user interface (managing databases, tables, fields, relations, indexes, users, permissions, etc), while you still have the ability to directly execute any SQL statement.

Including phpMyAdmin in our Tomcat stack means that we also needed to bundle a PHP runtime, but we believe the tradeoff was worth it. Enjoy!

New BitNami JasperReports 5.0 released

We are happy to announce a new major release of BitNami JasperReports stack, version 5.0. JasperReports is a popular open source Java report and analysis tool.

BitNami JasperReports provides all-in-one free native installers, virtual machines and Amazon Cloud Images that simplify JasperReports' installation.

In addition to this, we also provide simplified deployment and management of JasperReports in the cloud with BitNami Cloud Hosting. Sign up for our free developer plan to check it out!

This version ships the following components:

 -  JasperReports 5.0
 -  Apache Tomcat 7.0.33
 -  JDK 1.7.0_09
 -  MySQL 5.5.28

JasperReports 5 welcome page

JasperReports 5 sample report

Updated BitNami AMP Stacks for PHP development

We have just released updated versions of all of the BitNami AMP Stacks, which include a number of major updates and additions. If you are not familiar with the term, "AMP" stands for Apache-MySQL-PHP. The name of each BitNami AMP Stack depends on the operating system; there is WAMP for Windows, MAMP for OS X and LAMP for Linux.

We also release "APP" versions of these stacks, which include the PostgreSQL database instead of MySQL. As with the AMP Stacks, the APP Stacks are named differently for each operating system: WAPP for Windows, MAPP for OS X and LAPP for Linux.

All of the above BitNami Stacks have been updated to include the latest stable releases of their major components, which are listed below. We also offer development versions of the stacks which bundle beta or brand-new releases of the components. They are great for trying out the latest and greatest new releases in a contained environment.

• Apache 2.2.22  (or 2.4.3 in the development version)
• PHP 5.3.16  (or 5.4.6 in the development version)
• MySQL 5.5.21
• phpMyAdmin 3.5.2.2
• PostgreSQL 9.1.3 (optional)
• phpPgAdmin 5.0.4 (optional)

In addition to the above, the stacks bundle the following PHP frameworks for development:

• ZendFramework 1.12.0
• Symfony 2.0.17
• CakePHP 2.2.1
• CodeIgniter 2.1.2
• Smarty 3.1.11

Smarty is a new addition to the stacks with this latest release. It is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. This implies that PHP code is application logic, and is separated from the presentation.

Check our new Quick Start Guide to know how to start with BitNami AMP/APP Stacks.

Welcome page

Applications page

As usual, the BitNami AMP Stacks are available in the form of ready-to-run installers, virtual machine images (VMs) and Amazon Machine Images (AMIs) for the Amazon Cloud. You can also get simplified deployment and management of AMP / APP development environments in the cloud with BitNami Cloud Hosting. Sign up for our free developer plan to check it out!

BitNami is Coming to Windows Azure!

In connection with Microsoft’s release of new Infrastructure-as-a-Service (IaaS) capabilities to its cloud platform, we are very happy to announce that we are bringing your favorite BitNami apps to Windows Azure! In the very near future, we will be publishing two free images for Windows Azure, one focused on web development platforms and another with development environments.

The first image, BitNami DevPack,  provides an instant development environment for some of the most popular web development runtimes and servers, including PHP, Django, Ruby on Rails, Tomcat, MySQL, PostgreSQL and dozens of others. Everything you need to get started developing and hosting your own applications on Windows Azure is included in BitNami DevPack.

The other image, BitNami WebPack, includes ready to run versions of three of the most popular open source blog and CMS engines: WordPress, Drupal and Joomla!. It allows you to deploy full-featured websites in minutes which you can later customize with thousands of plugins and addons available for these platforms.

As with all BitNami Stacks, BitNami WebPack and DevPack for Azure are completely configured and ready-to-run, so you can have them up and running in minutes.

Sign up to be the among the first to know when these new images are available at: http://bitnami.org/azure. 

BitNami DjangoStack: Updates

We have recently released a new version of the BitNami DjangoStack. This version includes a major update in the MySQL database version to MySQL 5.5. Another improvement for the Linux and Mac OS X installers (also VMs and Linux AMIs) is that the Python Imaging Library is now included. We found that users were finding issues when trying to install PIL on top of the BitNami DjangoStack on Unix distributions especially in Mac OS X. In our aim to simplify the development and deployment of Django applications by providing a ready-to-run environment, we have now included this library in the BitNami DjangoStack.