Problems installing AutoGallery SQL..Help Please!

[Joey Skulls]

Hi all,

I recently purchased AutoGallery SQL from jmbsoft and the support team at jmb said that they couldnt install the software because of this reason:

"....The MySQL database that is currently setup does not have the necessary database privileges
for AutoGallery SQL. Specifically, AutoGallery SQL requires the Create_tmp_table_priv
MySQL database table privilege...."

After asking my server administrator, he said that there might security issues by allowing these database priviledges.

Is my server guy paranoid or is AutoGallery SQL not safe to install?

Please help!

[Spunky]

Your server guy is paranoid,tell him thousands of sites use it and I highly doubt if there was any security issues they would still be around..I would also tell him adios,I'm moving to a new host or ask him to talk to JMB if he has doubts

[schneemann]

Your server guy is paranoid,tell him thousands of sites use it and I highly doubt if there was any security issues they would still be around..I would also tell him adios,I'm moving to a new host or ask him to talk to JMB if he has doubts

I think if you don't know the answer to the question, you should not respond.

There are severe security risks when it comes to create_tmp_table_priv.

Creating tables using 'create_tmp_table_priv' allows only the calling user
to view that table within the current MySQL session. You can drop temp tables you make within a connection. Once a connection terminates, all temp tables are dropped. If a person forgets to drop temp tables and stays within a connection for hours or even days, memory resources can be overloaded a lot of temp tables.
Furthermore, loading temp tables with a GB of data is bad practice but is possible under such circumstances.

If a Server has been hacked using a mysql user that is not root, you want to be sure the mysql user being used in a hack does not create denial of service problems by ballooning temp tables here and there. Why worry about this scenario ???

Remember : TEMPORARY TABLES ARE NOT VISIBLE !!!!

EXAMPLE
-------
create temporary table test.namelist ( id int not null auto_increment, name varchar(100), primary key (id) );
insert into test.namelist (name) values ('JOHN'),('GROVER'),('JEFF'),('MIKE');

THEY DO NOT APPEAR when you run the following three ways:
1) use test
show tables;
2) select table_name from information_schema.tables where table_schema='test';
3) select table_name from information_schema.tables where table_name='namelist';

Yet, you can select from, delete from, insert into, and update temporary tables because they do exist.

mysql> select * from test.namelist;
+----+--------+
| id | name |
+----+--------+
| 1 | JOHN |
| 2 | GROVER |
| 3 | JEFF |
| 4 | MIKE |
+----+--------+
4 rows in set (0.00 sec)

Imagine the havoc a person could wreak maliciously or accidently with temporary tables.
Unless you know that exact name of the table, you cannot drop it. What makes this worse is that you have to be within the connection that created the temporary table in the first place to even manipulate it or delete it.

Of course, killing a connection drops all temporary tables created in the session of the MySQL connection. Shutting down MySQL drops all temporary tables from the server.

If this guy is on a shared server, he risks becoming a DDOS problem to all the other sites on his server.

[Joey Skulls]

Holy crap!

[brassmonkey]

check my sig

[CyberHustler]

Hi all,

I recently purchased AutoGallery SQL from jmbsoft and the support team at jmb said that they couldnt install the software because of this reason:

"....The MySQL database that is currently setup does not have the necessary database privileges
for AutoGallery SQL. Specifically, AutoGallery SQL requires the Create_tmp_table_priv
MySQL database table privilege...."

After asking my server administrator, he said that there might security issues by allowing these database priviledges.

Is my server guy paranoid or is AutoGallery SQL not safe to install?

Please help!

CHANGE HOSTS! go with HostHead.com

[2012]

don't use shared hosting. you really should have a dedicated server ... it depends on how they have things setup at the host for the most part ...

..

[zargan]

Hi all,

I recently purchased AutoGallery SQL from jmbsoft and the support team at jmb said that they couldnt install the software because of this reason:

"....The MySQL database that is currently setup does not have the necessary database privileges
for AutoGallery SQL. Specifically, AutoGallery SQL requires the Create_tmp_table_priv
MySQL database table privilege...."

After asking my server administrator, he said that there might security issues by allowing these database priviledges.

Is my server guy paranoid or is AutoGallery SQL not safe to install?

Please help!

One solution: change your hosting service ...

[smutx]

your host is weak, should go with www.yellowfiber.net