MySQL 5

#!/usr/bin/env python3
# verify_backronym.py
# Heuristic checker for BACKRONYM / CVE-2015-3152 exposure on local hosts.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import subprocess
import sys
from shutil import which

EXIT_PATCHED = 0
EXIT_VULN = 1
EXIT_UNKNOWN = 2


def run(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=8)
        return p.returncode, (p.stdout or '') + (p.stderr or '')
    except Exception:
        return 127, ''


def parse_version(text):
    # Accepts versions like 5.7.2, 5.5.44-MariaDB, 10.0.19-MariaDB
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def collect_evidence():
    evidence = []

    candidates = [
        ['mysql', '--version'],
        ['mysql_config', '--version'],
    ]

    for cmd in candidates:
        if which(cmd[0]):
            rc, out = run(cmd)
            if out.strip():
                evidence.append(('binary', cmd[0], out.strip()))

    # Package manager hints. These can be ambiguous because distros backport fixes.
    pkg_cmds = [
        ['rpm', '-qa'],
        ['dpkg-query', '-W', '-f=${Package} ${Version}\n'],
    ]

    for cmd in pkg_cmds:
        if which(cmd[0]):
            rc, out = run(cmd)
            if rc == 0 and out:
                for line in out.splitlines():
                    l = line.lower()
                    if any(x in l for x in ['mysql', 'mariadb', 'libmysqlclient', 'mysql-community', 'connector/c']):
                        evidence.append(('package', cmd[0], line.strip()))

    return evidence


def decide(evidence):
    # Prefer direct binary evidence over package names.
    binary_text = ' | '.join(x[2] for x in evidence if x[0] == 'binary')
    package_text = ' | '.join(x[2] for x in evidence if x[0] == 'package')

    if not evidence:
        return 'UNKNOWN', 'No MySQL/MariaDB client evidence found on host.'

    text = (binary_text or package_text).strip()
    t = text.lower()
    ver = parse_version(text)

    if not ver:
        return 'UNKNOWN', 'Version string could not be parsed.'

    # Distro package streams often backport without matching upstream versioning.
    if package_text and not binary_text:
        return 'UNKNOWN', 'Only package-manager evidence found; distro backports may already include the fix.'

    # MariaDB logic from NVD/oCERT change history.
    if 'mariadb' in t:
        if ver[0] == 5 and ver[1] == 5:
            if cmp_ver(ver, (5, 5, 44)) < 0:
                return 'VULNERABLE', f'MariaDB client appears older than 5.5.44: {ver}'
            return 'PATCHED', f'MariaDB client appears at or above 5.5.44: {ver}'
        if ver[0] == 10 and ver[1] == 0:
            if cmp_ver(ver, (10, 0, 20)) < 0:
                return 'VULNERABLE', f'MariaDB client appears older than 10.0.20: {ver}'
            return 'PATCHED', f'MariaDB client appears at or above 10.0.20: {ver}'
        return 'UNKNOWN', f'MariaDB detected, but version branch is not directly covered by this heuristic: {ver}'

    # Oracle/Percona/MySQL client heuristic aligned to plugin scope.
    if 'mysql' in t:
        if cmp_ver(ver, (5, 7, 3)) < 0:
            return 'VULNERABLE', f'MySQL client appears older than 5.7.3: {ver}'
        return 'PATCHED', f'MySQL client appears at or above 5.7.3: {ver}'

    return 'UNKNOWN', 'Unable to classify local client software.'


def main():
    evidence = collect_evidence()
    verdict, reason = decide(evidence)

    # Keep primary output machine-friendly.
    print(verdict)
    # Send evidence to stderr for operators.
    print(reason, file=sys.stderr)
    for kind, source, line in evidence[:20]:
        print(f'[{kind}:{source}] {line}', file=sys.stderr)

    if verdict == 'PATCHED':
        sys.exit(EXIT_PATCHED)
    if verdict == 'VULNERABLE':
        sys.exit(EXIT_VULN)
    sys.exit(EXIT_UNKNOWN)


if __name__ == '__main__':
    main()