Privileges Provided by MySQL • ALTER  may be used to subvert the privilege system by renaming tables. • SHUTDOWN  can be abused to deny service to other users entirely by terminating the server. • PROCESS  can be used to view the plain text of currently executing statements, including statements that set or change passwords. • SUPER  can be used to terminate other sessions or change how the server operates. •Privileges granted for the  mysql  system database itself can be used to change passwords and other access privilege information: •Passwords are stored encrypted, so a malicious user cannot simply read them to know the plain text password. However, a user with write access to the  mysql.user  system table authentication_string  column can change an account’s password, and then connect to the MySQL server using that account. • INSERT  or  UPDATE  granted for the  mysql  system database enable a user to add privileges or modify existing privileges, respectively. • DROP  for the  mysql  system database enables a user to remote privilege tables, or even the database itself. Static Versus Dynamic Privileges MySQL supports static and dynamic privileges: •Static privileges are built in to the server. They are always available to be granted to user accounts and cannot be unregistered. •Dynamic privileges can be registered and unregistered at runtime. This affects their availability: A dynamic privilege that has not been registered cannot be granted. For example, the  SELECT  and  INSERT  privileges are static and always available, whereas a dynamic privilege becomes available only if the component that implements it has been enabled. The remainder of this section describes how dynamic privileges work in MySQL. The discussion uses the term “components”  but applies equally to plugins. Note Server administrators should be aware of which server components define dynamic privileges. For MySQL distributions, documentation of components that define dynamic privileges describes those privileges. Third-party components may also define dynamic privileges; an administrator should understand those privileges and not install components that might conflict or compromise server operation. For example, one component conflicts with another if both define a privilege with the same name. Component developers can reduce the likelihood of this occurrence by choosing privilege names having a prefix based on the component name. The server maintains the set of registered dynamic privileges internally in memory. Unregistration occurs at server shutdown. Normally, a component that defines dynamic privileges registers them when it is installed, during its initialization sequence. When uninstalled, a component does not unregister its registered dynamic 1202