/etc/mysql/debian-start exposes debian-sys-maint users password to any users on the box via ps(1)

[James Troup]

After upgrading a box to Ubuntu 10.04 and rebooting it, I noticed (as
an unprivileged user) the following output in 'ps auxfwww':

root 1161 0.0 0.0 17676 760 ? S 12:40 0:00 /bin/bash /etc/mysql/debian-start
root 1163 0.0 0.0 19540 1260 ? S 12:40 0:00 \_ /usr/bin/mysql_upgrade --defaults-extra-file=/etc/mysql/debian.cnf
root 1174 0.0 0.0 4096 576 ? S 12:40 0:00 | \_ sh -c '/usr/bin/mysqlcheck' '--no-defaults' '--port=3306' '--socket=/var/run/mysqld/mysqld.sock' '--host=localhost' '--user=debian-sys-maint' '--password=KbZ6QzVFJa3DlRAOW' '--socket=/var/run/mysqld/mysqld.sock' '--host=localhost' '--user=debian-sys-maint' '--password=KbZ6QzVFJa3DlRAOW' '--socket=/var/run/mysqld/mysqld.sock' '--user=debian-sys-maint' '--check-upgrade' '--all-databases' '--auto-repair' '--write-binlog'
root 1175 0.0 0.0 27316 2036 ? S 12:40 0:00 | \_ /usr/bin/mysqlcheck --no-defaults --port=3306 --socket=/var/run/mysqld/mysqld.sock --host=localhost --user=debian-sys-maint --password=x xxxxxxxxxxxxxx --socket=/var/run/mysqld/mysqld.sock --host=localhost --user=debian-sys-maint --password=x xxxxxxxxxxxxxx --socket=/var/run/mysqld/mysqld.sock --user=debian-sys-maint --check-upgrade --all-databases --auto-repair --write-binlog
root 1164 0.0 0.0 6156 700 ? S 12:40 0:00 \_ egrep -v ^(1|@had|ERROR (1054|1060|1061))
root 1165 0.0 0.0 4000 652 ? S 12:40 0:00 \_ logger -p daemon.warn -i -t/etc/mysql/debian-start

And I confirmed that the exposed password is in fact the
debian-sys-maint password for this box.

(Also, it was quite some time after the box had booted, the exposure
 window is not short if you have a non-trivial database.)

[Gabriel Ramirez (gabriel1109)]

Hello, we apologize for the delayed response but as we are no longer able to reproduce this on a later version of Ubuntu, we are going to close this out. Thank you!