Security bugs are reported here via bugzilla

[Eric Sandall <eric AT sandall.us>]

Quoting Seth Woolley <seth AT tautology.org>:
> Why oh why.  Some things to mitigate mysql breakings:
> 
> in your /etc/my.cnf if you are only doing local connections:
> 
> [mysqld]
> skip-networking
> 
> we already run under mysql user with our init script as well.
> 
> I considered making a locked down /etc/my.cnf file by default that turned
> off networking by default.  Anybody opposed?
> 
> Is perforce coming back any time soon?  I usually have these patched and
> announced within a few hours of hearing, but I'm powerless now.  Might
> want to make a security announcement relating the pine and mysql exploits
> with a "will update when p4 comes back up" note.  Tony, can we elevate
> priority somehow?
> 
> Seth
> 
> P.S.  rarely will anybody get global admin privs for mysql and not be an
> admin on the box, so this exploit is mostly theoretical if I understand
> correctly, but we should update through to stable anyways.

I would prefere that all of our packages be secure-by-default (especially 
since
we don't ask the user to modify the files in most packages) and let the user
weaken their machine on their own.

Speaking of which, my mysql (4.0.14) doesn't have an /etc/my.cnf, is that bad?
It runs fine and my firewall doesn't allow outside connections to it anyways, 
but...

-sandalle

-- 
PGP Key Fingerprint:  FCFF 26A1 BE21 08F4 BB91  FAED 1D7B 7D74 A8EF DD61
http://search.keyserver.net:11371/pks/lookup?op=get&search=0xA8EFDD61

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS/E/IT$ d-- s++:+>: a-- C++(+++) BL++++VIS>$ P+(++) L+++ E-(---) W++ N+@ o?
K? w++++>-- O M-@ V-- PS+(+++) PE(-) Y++(+) PGP++(+) t+() 5++ X(+) R+(++)
tv(--)b++(+++) DI+@ D++(+++) G>+++ e>+++ h---(++) r++ y+
------END GEEK CODE BLOCK------

Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/

-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/