Vulnerability CVE-2002-1921 - CERT Civis.Net

Vulnerability Name:

CVE-2002-1921 (CCN-9908)

Assigned:

2002-08-18

Published:

2002-08-18

Updated:

2019-10-07

Summary:

The default configuration of MySQL 3.20.32 through 3.23.52, when running on Windows, does set the bind address to the loopback interface, which allows remote attackers to connect to the database.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: BugTraq Mailing List, Sun Aug 18 2002 - 12:15:57 CDT
Weak MySQL Default Configuration on Windows

Source: MITRE
Type: CNA
CVE-2002-1921

Source: BUGTRAQ
Type: UNKNOWN
20020818 Weak MySQL Default Configuration on Windows

Source: XF
Type: UNKNOWN
mysql-disabled-binding-loopback(9908)

Source: CCN
Type: OSVDB ID: 59907
MySQL on Windows bind-address Remote Connection Weakness

Source: BID
Type: UNKNOWN
5511

Source: CCN
Type: BID-5511
MySQL Bind Address Not Enabled Weak Default Configuration Vulnerability

Source: XF
Type: UNKNOWN
mysql-disabled-binding-loopback(9908)

Vulnerable Configuration:

Configuration 1:

cpe:/a:oracle:mysql:3.20.32a:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.22.26:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.22.27:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.22.28:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.22.29:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.22.30:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.22.32:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.8:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.9:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.10:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.23:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.24:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.25:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.26:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.27:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.28:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.28:gamma:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.29:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.30:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.31:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.34:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.36:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.37:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.38:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.39:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.40:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.41:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.42:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.43:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.44:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.45:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.46:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.47:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.48:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.49:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.50:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.51:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:3.23.52:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:mysql:mysql:*:*:*:*:*:*:*:*

Denotes that component is vulnerable