CVE-2020-28912: 
MariaDB Server vulnerability analysis and mitigation

CVE-2020-28912 is a security vulnerability affecting MariaDB running on Windows systems. The vulnerability allows an unprivileged user with code execution ability on the server machine to intercept named pipe connections and perform man-in-the-middle attacks. This affects MariaDB Server versions before 10.1.48, 10.2.x before 10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. The issue exists because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants (NVD).

The vulnerability stems from an incorrect security descriptor in the Windows named pipe implementation. When local clients connect to the server over named pipes, an unprivileged user can create a pipe instance using the same name as the server does with CreateNamedPipe("\.\pipe\MySQL",...) and wait for client connections. This allows the attacker to act as a proxy, forwarding and reading clear-text messages between the real server and the real client. The vulnerability received a CVSS v3.1 Base Score of 7.0 (HIGH) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (MDEV-24040).

If exploited, this vulnerability allows attackers to gain access to all data passed between the client and the server, and obtain the ability to run SQL commands on behalf of the connected user. This represents a significant breach of data confidentiality and integrity for affected MariaDB installations on Windows systems (NVD).

The vulnerability requires local access to the affected system and the ability to execute code on the server machine. While this limits the attack surface, the vulnerability is considered high risk due to the potential impact. To exploit the vulnerability, an attacker needs to create a named pipe instance with the same name as the server and intercept client connections (MDEV-24040).

The vulnerability has been patched in MariaDB versions 10.1.48, 10.2.35, 10.3.26, 10.4.16, and 10.5.7. Organizations should upgrade to these versions or later to protect against this vulnerability. The fix involves implementing proper ACL on named pipes to exclude FILE_CREATE_PIPE_INSTANCE for anyone but the creator (MDEV-24040).