{"id":571,"date":"2007-06-14T10:09:50","date_gmt":"2007-06-14T15:09:50","guid":{"rendered":"http:\/\/www.bytebot.net\/blog\/archives\/2007\/06\/14\/mysql-and-security-what-do-you-consider-a-security-hole-that-warrants-immediate-action"},"modified":"2007-06-14T10:09:54","modified_gmt":"2007-06-14T15:09:54","slug":"mysql-and-security-what-do-you-consider-a-security-hole-that-warrants-immediate-action","status":"publish","type":"post","link":"https:\/\/www.bytebot.net\/blog\/archives\/2007\/06\/14\/mysql-and-security-what-do-you-consider-a-security-hole-that-warrants-immediate-action","title":{"rendered":"MySQL and Security: what do you consider a security hole that warrants immediate action?"},"content":{"rendered":"<p>I don&#8217;t claim to be a security expert, but I&#8217;d like opinions from people in the field, as well as database experts that view security highly. Here are some opinions from a discussion with <a href=\"http:\/\/karateandvoodoo.blogspot.com\/index.html\">Chad<\/a> and <a href=\"http:\/\/www.lenzg.org\/\">Lenz<\/a> a while ago. <b>What do you consider a security hole, that warrants immediate action or a release of a server within a sensible timeframe?<\/b><\/p>\n<ul>\n<li>Remotely exploiting MySQL without login credentials<\/li>\n<li>Remotely crashing MySQL without login credentials<\/li>\n<\/ul>\n<p>The above two are definite problems. What about: <\/p>\n<ul>\n<li>denial of service attacks<\/li>\n<li>data loss<\/li>\n<li>data changes<\/li>\n<li>data insertion<\/li>\n<\/ul>\n<p>Chad tells us, &#8220;security is policy enforcement.&#8221; And the policy should state: &#8220;the service should always be available to authorized people, never to unauthrized people&#8221;. <\/p>\n<p>Opinions, please. Tell me what are on the &#8220;definite list&#8221; that should be fixed within 24-hours, whats on the possibly annoying list, that should be released within 72-hours, and whats on the its an annoying bug, but its not a &#8220;high&#8221;\/&#8221;large&#8221; security violation (like, Chad finds &#8220;a function SUBSTR that always returns one too few characters&#8221; a problem in his definition) which can be fixed during the next release cycle.<\/p>\n<p>Also, if anyone has pointers to how other OSS projects or major release software deals with security. Say, like Mark Cox&#8217;s <a href=\"http:\/\/www.awe.com\/mark\/blog\/tags\/security\">security<\/a> information (he&#8217;s Mr. Security at Red Hat, and they&#8217;ve got some amazing turnaround times).<\/p>\n<p>Technorati Tags: <a class=\"performancingtags\" href=\"http:\/\/technorati.com\/tag\/mysql\" rel=\"tag\">mysql<\/a>, <a class=\"performancingtags\" href=\"http:\/\/technorati.com\/tag\/security\" rel=\"tag\">security<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>I don&#8217;t claim to be a security expert, but I&#8217;d like opinions from people in the field, as well as database experts that view security highly. Here are some opinions from a discussion with Chad and Lenz a while ago. What do you consider a security hole, that warrants immediate action or a release of [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[23],"tags":[],"class_list":["post-571","post","type-post","status-publish","format-standard","hentry","category-mysql"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/p4vJD-9d","jetpack_sharing_enabled":true,"jetpack-related-posts":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/posts\/571","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/comments?post=571"}],"version-history":[{"count":0,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/posts\/571\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/media?parent=571"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/categories?post=571"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.bytebot.net\/blog\/wp-json\/wp\/v2\/tags?post=571"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}