MySQL 3.20.32 - 3.23.52 Weak Default Configuration

high Nessus Plugin ID 17821

Language:

Synopsis

The default configuration of the remote database server may be weak.

Description

The version of MySQL installed on the remote host is 3.20.32 to 3.23.52. On Windows, the default configuration used in these versions is weak :

- The database server binds to all network interfaces and can be reached from outside. (CVE-2002-1921)

- Logging is disabled, attackers will not be detected. (CVE-2002-1923)

- root's password is blank. (CVE-2002-1809)

Solution

Edit the configuration file and add this line if needed :

bind-address=127.0.0.1

Plugin Details

Severity: High

ID: 17821

File Name: mysql_3_weak_default_config.nasl

Version: 1.8

Type: remote

Family: Databases

Published: 1/18/2012

Updated: 11/15/2018

Configuration: Enable paranoid mode

Supported Sensors: Frictionless Assessment Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:mysql:mysql

Required KB Items: Settings/ParanoidReport

Exploit Ease: No exploit is required

Vulnerability Publication Date: 10/1/2002

Reference Information

CVE: CVE-2002-1809, CVE-2002-1921, CVE-2002-1923

BID: 5503, 5511, 5513

Detections

Analytics