Security vulnerabilities in the NFA environment

book

Article ID: 197311

calendar_today

Updated On:

Products

CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

A scan in our environment revealed that a vulnerability was found.

Vulnerability: High
Plugin: MySQL User-Defined Functions Multiple Vulnerabilities

Proposed Solution:
There is currently no known fix or patch to address these issues. Instead, make sure access to create user-defined functions is restricted.


Cause

MySQL anon user is able to create UDF.

Environment

Release : 10.0

Component : NQRPTA - REPORTERANALYZER

Resolution

Enter the database as root to be able to edit the privileges:
mysql -u root

Once in the database as root, enter the following commands to edit the granted privileges:
revoke create on *.* from ''@'localhost';
revoke create on `reporter`.* from ''@'localhost';