I have configured my MySQL Database to require passwords on all users, even root from the machine itself.
Now I discovered that there are empty Users in my Database
mysql -u root -p and then
use mysql; &
select * from user;
It gives me 2 entries, one with "localhost" and user <empty> and one with the machine's hostname and <empty>.
Now I tried to access the account with
mysql -u ' ' (yes it's correct, leave a space between the ' things)
and I log in without a password.
The user can "only" see information_schema and test, the two databases created by default.
He does not has access to mysql or any other custom created databases.
I already changed the Password of this user to something I won't tell you
mysql -u root -p use mysql; UPDATE mysql.user SET Password=PASSWORD('thisisasecretpassword') WHERE USER='root'; FLUSH PRIVILEGES;
Now my Questions:
Is any MySQL Server vulnerable for an attack with this entry?
Could an attacker break out of this account or the two default databases?
Should I password-protect those Users or can I delete them? Are They required for some MySQL-internal things?