MySQL security loophole with server,database and user name exposed

Question

I have the following situation: Ona score of weakly secured machines a business critical application is installed. The application uses a MySQL 4 database where all the business critical data are stored.

Each application installation has a configuration file stored in ascii format which can be read and written by anyone who has access to the computer in questions.

The following information is exposed:

Server Name

Database Name

User Name

My Question is this:

1. How much damage, or how big a security loophole, is this for a dedicated attacker?
2. How much damage, or how big a security loophole, is this for a mid experienced attacker?
3. What types of attacks the database is susceptible to?

Answer 1

Each application installation has a configuration file stored in ascii format which can be read and written by anyone who has access to the computer

Well, don't do that then. Change the permissions on the file in question so that only those users who need to be able to read it can do so.

Answer 2

That basically means the security of the box itself becomes your last line of defense. So make sure your logins are secured and the applications that are exposed to the outside of the box don't have any exploits. It's possible to do this; after all you have to put the fences somewhere, but usually having more than once fence is a good idea. It depends on the nature of the applications and the data, who the attackers might be, and what value all of this has to them.

Answer 3

I hope that system isn't exposed to the Internet. If it is then figure the risks are similar to parking a car in a public place (the Internet) with the doors unlocked (weak machine security) with the keys sitting on top of the sun visor (only the password needs to be guessed, everything else is there).