Password flaw leaves MySQL open to brute force attack

[PharCyder]

Http://www.theregister.co.uk/2012/06/11 ... word_flaw/

I would imagine that we're vulnerable too.

[pwilson]

Http://www.theregister.co.uk/2012/06/11/mysql_mariadb_password_flaw/

I would imagine that we're vulnerable too.

Surely the risk of external attack can be resolved by simply not allowing access to port 3306 on the WAN port of the router, and not forwarding traffic that arrives from external IP's to the MySQL server.

This wouldn't protect from internal attacks on the LAN tho'.

Patrick.

[forkless]

That and we don't exactly know how MySQL was compiled. It seems that only versions that don't use the included memcp library function (eg. via glibc offered by the OS) are affected.Would be nice if we could get some confirmation from QNAP though.