CVE-2002-1921 in MySQL
Summary
by MITRE
The default configuration of MySQL 3.20.32 through 3.23.52, when running on Windows, does set the bind address to the loopback interface, which allows remote attackers to connect to the database.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/25/2019
The vulnerability described in CVE-2002-1921 represents a critical network configuration flaw in MySQL database servers running on Windows platforms. This issue affects MySQL versions from 3.20.32 through 3.23.52, where the default installation configuration fails to properly restrict database access to local connections only. The fundamental problem lies in the absence of proper network binding restrictions that would normally limit database server accessibility to localhost connections exclusively. When MySQL operates without explicitly setting the bind address parameter, it defaults to listening on all available network interfaces, creating an unintended attack surface that exposes database services to remote network access.
The technical implementation of this vulnerability stems from MySQL's default behavior on Windows systems where network security settings are not properly enforced during installation. The bind address configuration parameter, which should restrict the database server to respond only to connections from the loopback interface, is either omitted or incorrectly configured in the default installation process. This misconfiguration allows any remote attacker with network access to establish connections to the MySQL service, bypassing any intended local-only access controls. The vulnerability directly maps to CWE-668, which describes "Exposure of Resource to Wrong Sphere" where a resource is made accessible to a sphere for which it was not intended. This misconfiguration creates an attack vector that aligns with ATT&CK technique T1190, "Exploit Public-Facing Application," as it enables remote exploitation of database services without requiring authentication or prior access to the system.
The operational impact of this vulnerability is significant for organizations deploying MySQL databases on Windows servers. Remote attackers can potentially access database services without authentication, allowing for data exfiltration, database manipulation, or even complete system compromise through subsequent attacks. The vulnerability affects the confidentiality, integrity, and availability of database systems, as unauthorized parties can connect to database instances, potentially leading to data breaches or service disruption. Organizations with default MySQL installations on Windows platforms face an increased risk of exploitation, particularly in environments where network segmentation is not properly implemented. The attack surface expands beyond local administrative access, allowing network-based threats to directly target database services and potentially escalate to broader system compromises.
Mitigation strategies for this vulnerability must address both immediate configuration fixes and long-term security practices. The primary remediation involves explicitly setting the bind address parameter in MySQL configuration files to restrict connections to localhost only, typically by setting bind-address=127.0.0.1 or bind-address=::1 for IPv6. System administrators should also implement proper network segmentation, ensuring that database servers are not directly accessible from untrusted networks. Additional protective measures include implementing firewall rules to restrict access to MySQL ports, applying the latest security patches, and conducting regular security audits of database configurations. Organizations should also establish proper access controls and authentication mechanisms, as this vulnerability primarily affects the network accessibility rather than authentication mechanisms themselves. The remediation process should include comprehensive testing to ensure that legitimate local applications can still access the database service while preventing unauthorized remote connections. This vulnerability underscores the importance of proper security configuration management and the principle of least privilege in database deployment practices.