Security Basics mailing list archives

Re: System Hacked from MySQL Insecurities

From: Danux <danuxx () gmail com>
Date: Thu, 6 Jan 2005 15:47:10 -0600

Of course yes, may be it was a buffer overflow attack. You should
check if your Mysql versión for FreeBSD is vulnerable.

check nessus

On Thu, 06 Jan 2005 09:02:38 +0700, Kalpin Erlangga Silaen
<kalpin () solonet co id> wrote:

Dear all,

several days ago, someone hacked my test box using the latest FreeBSD.
He explained that he rooted my box because he knows my root mysql
password. Is it possible to hack system via MySQL ? or he just tricked
me and try hide his way ? I am using MySQL 4.0.18 for FreeBSD.
My details system:

OS: FreeBSD 5.1
MySQL version: 4.0.18
Port : 3306

I opened port 3306 from Internet, so people can use this if they have
access/username to MySQL.

Thank you.

--
---
Kalpin Erlangga Silaen
mailto: kalpin () solonet co id
URL: http://www.warningnews.com
YM: kalpinus
MSN: kalpinus
IRC: mesra.dal.net nick Kalpin



-- 
Danux

Current thread:

System Hacked from MySQL Insecurities Kalpin Erlangga Silaen (Jan 06)
- RE: System Hacked from MySQL Insecurities Shawn Wall (Jan 06)
- Re: System Hacked from MySQL Insecurities bernie (Jan 07)
  - Re: System Hacked from MySQL Insecurities Kalpin Erlangga Silaen (Jan 07)
- Re: System Hacked from MySQL Insecurities Danux (Jan 07)
- <Possible follow-ups>
- RE: System Hacked From MySQL Insecurities Saint Anthony (Jan 07)
- RE: System Hacked from MySQL Insecurities Ed Gorski (Jan 07)
  - RE: System Hacked from MySQL Insecurities Kalpin Erlangga Silaen (Jan 10)
    - Re: System Hacked from MySQL Insecurities q q (Jan 14)