I have configured my MySQL Database to require passwords on all users, even root from the machine itself.
Now I discovered that there are empty Users in my Database
mysql -u root -p and then
use mysql; &
select * from user;
it gives me 2 entries, one with "localhost" and user and one with the machine's hostname and .
now i tried to access the account with
mysql -u ' ' (yes it's correct, leave a space between the ' things)
and I log in without a password.
The user can "only" see information_schema and test, the two databases created by default.
He does not has access to mysql or any other custom created databases.
I already changed the Password of this user to something I won't tell you
mysql -u root -p
UPDATE mysql.user SET Password=PASSWORD('thisisasecretpassword') WHERE USER='root';
but yeah now my Question:
Is any MySQL Server vulnerable for an attack with this entry?
Could an attacker break out of this account or the two default databases?
Should I password-protect those Users or can I delete them? Are They required for some MySQL-internal things?