Re: [Full-Disclosure] MySQL and the user "su"
From: Sascha Wolf (swolf_at_x-project.net)
Date: 12/31/04
- Previous message: Santiago Cortes: "[Full-Disclosure] Arbitrary file inclusion in SugarCRM [PHP]"
- Maybe in reply to: Sascha Wolf: "[Full-Disclosure] MySQL and the user "su""
- Next in thread: Tom Crimmins: "RE: [Full-Disclosure] MySQL and the user "su""
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 31 Dec 2004 19:47:02 +0100 To: full-disclosure@lists.netsys.com
Dear Tom Crimmins,
am Freitag, 31. Dezember 2004 um 17:42 schrieben Sie:
> [snip]
> I have today determined that I can connect to a local MySQL-server per
> "mysql -usu". I regard that to error, can that someone confirm?
> [/snip]
> This is not an error. You should by default be able to connect with any user
> from localhost, but you will not have privileges to do anything else. This
> is because the mysql install by default sets up permissions this way. You
> could verify this yourself by connecting as root, and executing the
> following query:
> SELECT * FROM mysql.user;
> The row that applies in this case is the one with Host='localhost' and
> User=''. You can delete this row if you do not want this behavior. You must
> do a "flush privileges;" after deleting the row.
> ---
> Tom Crimmins
> Interface Specialist
> Pottawattamie County, Iowa
Ok one if I the user deletes, I can't no more connection. But for what MySQL puts
on this user at all, if he is not used?
I think that is a securitybug to be evaluated.
-- Mit freundlichen Grüßen Sascha Wolf mailto:swolf@x-project.net
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- application/pkcs7-signature attachment: S/MIME Cryptographic Signature
- Previous message: Santiago Cortes: "[Full-Disclosure] Arbitrary file inclusion in SugarCRM [PHP]"
- Maybe in reply to: Sascha Wolf: "[Full-Disclosure] MySQL and the user "su""
- Next in thread: Tom Crimmins: "RE: [Full-Disclosure] MySQL and the user "su""
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
