full-disclosure - Proofpoint Protection Server remote MySQL r oot user vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: fulldisclosure at pottcounty.com (Tony Kava)
Subject: Proofpoint Protection Server remote MySQL r
	oot user vulnerability

Hello ... Comments follow the quotation.

> Product: Protection Server
> Version: unknown/Red Hat Linux
> Developer: Proofpoint
> URL: www.proofpoint.com
> 
> Summary:
> The MySQL server may be remotely access by the "root" user 
> without using
> a password.
> 
> Details:
> 
> ... 
> 
> By default, the embedded MySQL 4.0 server binds to the 
> default port (3306/tcp)
> on every IP.  The software has no packet filtering or port 
> restrictions
> of it's own, so all bound ports are wide open to the network.
> 
> The specific flaw is that the "root" user in MySQL is not restricted
> from connecting from any host ('%') and additionally the root user HAS
> NO PASSWORD.

Are you sure this is the default behaviour of a Red Hat installation? Your
advisory does not indicate any specific version(s) of Red Hat Linux.  Is
this supposed to apply to RHL 7.2? 7.3? 8.0? 9.0? Fedora 1? In my previous
experience with the 'mysql-server' package on any Red Hat the root user is
granted full access without a password, but that is limited only to
connections from the localhost.  I've verified that the most up-to-date
'mysql-server' package for Red Hat Enterprise Linux 3 still falls in the 3.x
version, not 4.x.  The package name is mysql-server-3.23.58-1.  Additionally
with this package from Red Hat the root user without a password is limited
to the localhost only.

Perhaps you could provide some more specific details such as the version of
Red Hat Linux you used, the package you used to install MySQL (as well as
its source), or the third-party installation you used (perhaps a tar ball
from the MySQL project?).  I don't think Red Hat will take your advisory
seriously unless you can point out the particulars of this vulnerability.

Regards,

--
Tony Kava
Senior Network Administrator
Pottawattamie County, Iowa