Re: KSR[T] Advisory #10: mSQL ServerStats

[john () KUWAIT NET (John W. Temples)]

On Mon, 15 Feb 1999, Dave G. wrote:

> Compromise:          If host based access control is disabled, a
>                      remote attacker can use the user names listed in
>                      the connection table to access databases.  If host
>                      based access control is enabled, a remote attacker
>                      could launch a more complex attack (like DNS cache
>                      poisoning) to access mSQL databases.

This is hardly news; mSQL's access control is extremely weak.
ServerStats probably makes it easier to get into an mSQL database, but
if remote access is enabled, you simply need to know an authorized
username (say, "root") to log into the database -- there are no
passwords.  And you don't even need a username to perform DoS attacks,
since mSQL is a single-threaded server -- just telnet to mSQL's port
and sit there.  As far as I can see, the only thing that's changed
since I posted about this in September, 1997, is that remote access is
now disabled by default.

--
John W. Temples, III       ||       Providing the first public access Internet
Gulfnet Kuwait             ||            site in the Arabian Gulf region