[SM-Discuss] MySQL and nessus...

David Pradier pradierdavid at yahoo.fr
Sun Oct 13 16:47:14 EDT 2002


Hi, i just ran a nessus on my localhost to see if i had any vulnerability.

Here is what it said me:
--------------------------------------------------------
Your MySQL database is not password protected.

Anyone can connect to it and do whatever he wants to your data
(deleting a database, adding bogus entries, ...)
We could collect the list of databases installed on the remote host :

. mysql
. test

Solution : Log into this host, and set a password for the root user
through the command 'mysql -u root password <newpassword>'
Read the MySQL manual (available on www.mysql.com) for details.
In addition to this, it is not recommanded that you let your MySQL
daemon listen to request from anywhere in the world. You should filter
incoming connections to this port.

Risk factor : High
---------------------------------------------------------

Well...
I didn't installed and tweaked mysql myself ; i guess i installed it as a 
dependency to have i dunno which additional service in i dunno which piece of 
software.

But...
It remains that i have a hole.
What do you think about it concerning what i should do, and what it implies 
for the distro ?

day



More information about the SM-Discuss mailing list