Horde webmail: mysql access

[sig@flaming.tolna.net]

Hello

I've found a very interesting feature in Horde webmail system...

Horde is a very popular PHP based webmail system, with many accessories. Most of these web applications (for example: turba, mnemo, etc) are using mysql
database server, to store e-mail addresses, user memos, informations about users, sometimes passwords etc.

By default, You can access to these database servers, with the username: "horde" and with no password, from a remote host.
Then you will have permission to list the databases, and to use some of them. In fact, "horde" and "test" databases are available for reading, and
writing, in many cases.

I think it is dangerous; There are many open-wide database servers around the world -> everybody can use them for their own purposes.
(Horde users personal memos, address lists, and (sometimes their) passwords are also accessible)

This is not a bug, this is a feature. (?)
Problem can be solved using a configured firewall, or an ACL, or just deny the connections from outside and allow only localhost for mysqld.

ps: i think, unwanted connections from the internet can cause Denial of Service attacks; too many db queries, or storing long size datas can be
dangerous ...
what do you think about it?


sigterm <sigterm@c3.hu>
<sig@flaming.tolna.net>

[Christopher T. Beers]

--On Sunday, April 25, 2004 11:11 PM +0200 sig@flaming.tolna.net wrote:

| Hello
| ....
| By default, You can access to these database servers, with the username:
| "horde" and with no password, from a remote host. Then you will have
| permission to list the databases, and to use some of them. In fact,
| "horde" and "test" databases are available for reading, and writing, in
| many cases.
|
| ....

If you read the horde_src/docs/INSTALL file there is a section when you
configure it that says

Be sure to change the default password, "horde", to something
else before creating the tables! (Remember to use this password
when you configure Horde in the next step.)

Also the script that creates the mysql database located at
horde_src/scripts/db/mysql_create.sql has the following items. Again a
warning about changing the password...

USE mysql;

REPLACE INTO user (host, user, password)
VALUES (
'localhost',
'horde',
-- IMPORTANT: Change this password!
PASSWORD('horde')
);

Obviously, this was overlooked in whatever installation you were looking
at. In fact, it looks like your administrator removed the default horde
password and replaced it with nothing...even worse than using the default
password.

--
Christopher T. Beers
UNIX Systems Engineer - Syracuse University
250 Machinery Hall Syracuse, NY 13244
(315) 443-4103 Office (315) 443-1621 Fax