RE: System Hacked from MySQL Insecurities

["Ed Gorski" <Ed.Gorski () ci tampa fl us>]

Shawn,

    I think the question here is if his machine could get rooted
THROUGH hacking MYSQL.  Sure if the machine root and MYSQL root
passwords are the same then your machine could be compromised but NOT
through MYSQL.  If the hacker has your MYSQL root password then he can
mess with MYSQL and only MYSQL.

~ed  


--------------------------------------------------------
Edmund Gorski
Application Systems Analyst
Strategic Planning & ITS
City of Tampa
e: Ed.Gorski () tampagov net
p: 813-274-8488
--------------------------------------------------------

> > > Shawn Wall <sjwall () shaw ca> 1/6/2005 1:20:19 PM >>>
MySql installs with a default root password or no password. If you did
not
change it then it would be trivial to 'hack'.

shawn

-----Original Message-----
From: Kalpin Erlangga Silaen [mailto:kalpin () solonet co id] 
Sent: Wednesday, January 05, 2005 7:03 PM
To: security-basics () lists securityfocus com 
Subject: System Hacked from MySQL Insecurities

Dear all,

several days ago, someone hacked my test box using the latest FreeBSD.

He explained that he rooted my box because he knows my root mysql
password.
Is it possible to hack system via MySQL ? or he just tricked me and try
hide
his way ? I am using MySQL 4.0.18 for FreeBSD.
My details system:

OS: FreeBSD 5.1
MySQL version: 4.0.18
Port : 3306

I opened port 3306 from Internet, so people can use this if they have
access/username to MySQL.

Thank you.

--
---
Kalpin Erlangga Silaen
mailto: kalpin () solonet co id 
URL: http://www.warningnews.com 
YM: kalpinus
MSN: kalpinus
IRC: mesra.dal.net nick Kalpin