[SM-Discuss] MySQL and nessus...
David Pradier
pradierdavid at yahoo.fr
Sun Oct 13 16:47:14 EDT 2002
Hi, i just ran a nessus on my localhost to see if i had any vulnerability.
Here is what it said me:
--------------------------------------------------------
Your MySQL database is not password protected.
Anyone can connect to it and do whatever he wants to your data
(deleting a database, adding bogus entries, ...)
We could collect the list of databases installed on the remote host :
. mysql
. test
Solution : Log into this host, and set a password for the root user
through the command 'mysql -u root password <newpassword>'
Read the MySQL manual (available on www.mysql.com) for details.
In addition to this, it is not recommanded that you let your MySQL
daemon listen to request from anywhere in the world. You should filter
incoming connections to this port.
Risk factor : High
---------------------------------------------------------
Well...
I didn't installed and tweaked mysql myself ; i guess i installed it as a
dependency to have i dunno which additional service in i dunno which piece of
software.
But...
It remains that i have a hole.
What do you think about it concerning what i should do, and what it implies
for the distro ?
day
More information about the SM-Discuss
mailing list