| Bug #8813 | Allowing un-registered users to login, when tried wihtout password | ||
|---|---|---|---|
| Submitted: | 25 Feb 2005 17:08 | Modified: | 25 Mar 2005 17:17 |
| Reporter: | Rupesh Kumar Sunkara | Email Updates: | |
| Status: | No Feedback | Impact on me: | |
| Category: | MySQL Server | Severity: | S2 (Serious) |
| Version: | 4.1.10 | OS: | Windows (Windows 98 SE) |
| Assigned to: | CPU Architecture: | Any | |
[25 Feb 2005 17:17]
MySQL Verification Team
Check that you don't have entry for anonymous user the the user table and that server isn't running with skip-grant-tables option.
[26 Mar 2005 0:00]
Bugs System
No feedback was provided for this bug for over a month, so it is being suspended automatically. If you are able to provide the information that was originally requested, please do so and change the status of the bug back to "Open".
Description: (1) Mysql when runs from command prompt is allowing un-registered users to login and manipulate the database. (2) Mysql when connected through "MySQL ODBC 3.51 Driver" also allowing un-registered users to login and manipulate the database. How to repeat: The users in the USER table are 'root' and 'user1' (Registered users). 1) If try "mysql -u user2", where 'user2' is not registered in the database; Mysql is still allowing that un-authorized entry. If tried to login with password as, "mysql -u user2 -p", it is refusing for entry. 2) If try connecting to MySql through "MySQL ODBC 3.51 Driver" from Visual Basic 6.0 (SP6) with un-registered users in the database; Mysql is still allowing that un-authorized entry. Connect string used in VB 6 application is, "DRIVER={MySQL ODBC 3.51 Driver};" _ & "SERVER=localhost;" _ & "DATABASE=vpos;" _ & "UID=user2;" _ & "OPTION=" & 1 + 2 + 8 + 32 + 2048 + 16384 If tried to login with password as follows, it is refusing for entry. Connect string used in VB 6 application is, "DRIVER={MySQL ODBC 3.51 Driver};" _ & "SERVER=localhost;" _ & "DATABASE=vpos;" _ & "UID=user2;" _ & "PWD=Use:r?2;" _ & "OPTION=" & 1 + 2 + 8 + 32 + 2048 + 16384 Suggested fix: Should not allow un-authorized entry to the Server, which may allow hackers to destroy the database.