Re: serious bug allows anyone access to database as root

[Michael Widenius]

Hi!

>>>>> "sasha" == sasha  <sasha@stripped> writes:

sasha> Matt Vermette wrote:
>> 
>> I have been able to replicate this on RedHat 6.2, Kernel 2.2.15 compiled on an
> i486, with MySQL 3.22.32


sasha> The problem has to do with the fact that by default, the priv system allows you
sasha> to connect as any user to the from localhost because of % entry in the user
sasha> table - to fix:

sasha> mysql -uroot mysql
mysql> delete from user where user = '%';
mysql> flush privileges;

Just to clarify;  If you use -u root-p you are logged in as an
anonymous user that only has access to the test databases (databases
which names start with 'test')

Regards,
Monty