BLOCK SELECT INTO OUTFILE ?

2005-08-24 Thread Alejandro Gad 
Hi,

I am going to implement a mysql hosting, and I would to make a question,
if a mysql-user with only a "SELECT" privilege make this query:

SELECT * FROM table1 INTO OUTFILE '/mysqldb/data/test.sql';

the result is a file in this path with the content of the table. 
I could think that a malicious user can do several querys like this and fill
my disk. 
How could I secure this command ?

Thanks!!

--
MySQL General Mailing List
For list archives: http://lists.mysql.com/mysql
To unsubscribe:http://lists.mysql.com/[EMAIL PROTECTED]

Re: security question CAN-2005-0709 CAN-2005-0710 CAN-2005-0711

2005-08-16 Thread Alejandro Gad 
I agree with you, 
I will upgrade .
Thanks for the advice.

On 8/16/05, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
>  
>  
> Alejandro <[EMAIL PROTECTED]> wrote on 08/16/2005 03:01:59 PM:
> 
>  
>  > Hi,
>  > 
>  > I have installed binary mysql version 3.23.58 downloaded from
> www.mysql.org. 
>  > In changelog from the documentation say that the release is from
>  > september 2003 and the security bug is in March 2005.
>  > What can I do ? How mysql provide updates?
>  > Thanks!!
>  > 
>  > =
>  > Security info:
>  >
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0709
>  >
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0710
>  >
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0711
>  > 
>  
> MySQL has moved WELL past the 3.23.x lineage and is getting close to
> retiring the 4.0.x lineage (it's only a rumor). So I suggest you update your
> installation, paying attention to all of the version-to-version gotchas
> listed here: 
>  
> http://dev.mysql.com/doc/mysql/en/upgrade.html 
>  
> There is little to no activity in support of the 3.23.x version of MySQL. Is
> there a "VERY GOOD" reason why you cannot or do not want to upgrade? 
>  
> Shawn Green
>  Database Administrator
>  Unimin Corporation - Spruce Pine

--
MySQL General Mailing List
For list archives: http://lists.mysql.com/mysql
To unsubscribe:http://lists.mysql.com/[EMAIL PROTECTED]