New Tool Checks To See If MySQL Servers Are At Risk From The MySQL CVE-2012-2122 Vulnerability
Rapid7 has released a tool that enables administrators to scan an unlimited number of IP addresses for the MySQL Authentication Bypass vulnerability, which caused a great deal of concern when it was discovered earlier this summer.
At the United Security Summit last week, Rapid7’s HD Moore said that of the 3 million MySQL servers discovered online, half of them were running without any sort of ACL (Access Control List) on the host. With this clear lack of restrictions on potential abuse, that means 1.5 million systems are vulnerable to CVE-2012-2122, in addition to any other flaws that may exist, which is easily determined by fingerprinting the system.
The tool released today will allow IT teams a quick and easy check to determine if their MySQL deployments are vulnerable. If they are, then all that’s needed is a patch. For the record, MySQL deployments that are older than 5.1.63, 5.5.24, or 5.6.6 are all vulnerable to the authentication bypass problem.
Even now, after the patches to this problem were delivered, some 90,000 systems are vulnerable to attack. This figure doesn’t include the number of potential vulnerable hosts that cannot be seen from the outside, but could be attacked from within later.
“If you are responsible for a MySQL server that is currently exposed to the network unnecessarily, the easiest thing to do is to modify the my.cnf file in order to restrict access to the local system,” Moore explained in a blog post back in June. “Open my.cnf with the editor of your choice, find the section labeled [mysqld] and change (or add a new line to set) the “bind-address” parameter to “127.0.0.1”. Restart the MySQL service to apply this setting.”
The ScanNow tool is free, and can be downloaded here. It runs on Windows and doesn’t require installation.