1

I'm pretty sure the answer is "no", but who knows.

Is a MySQL database able to initiate a communication with the server without any human action ?

This server is disconnected from the exterior world and there is no scripting-language file on it.

1

1 Answer 1

5

Any service running with a publicly-accessible port can be attacked and therefore be harmful to a server, and there have been some recent exploits against MySQL that can allow arbitrary code execution:

http://www.securitytracker.com/id/1029708
http://www.securitytracker.com/id/1029184

There are also ways to cause MySQL to fill up all available disk space and overwrite files using nothing but valid SQL if MySQL is improperly managed. Imagine MySQL running on a server with a single partition and a malicious user adding tons of rows to a table (I have seen it happen).

But "malicious" is not a term I would ascribe to either PHP or MySQL because that suggests the only intent of the software is to cause harm. I am not sure exactly what you are asking here. If I have gone down the wrong path, please clarify your question and I'll re-answer.

EDIT: Given the stringent requirements of your question (assuming by "no scripting language" you mean "nothing interacts with MySQL"), then MySQL is not going to make any connections by itself. It's like Apache running on a server's localhost interface and doing nothing with it. Your scenario is a bit academic, though, and I still wouldn't leave MySQL on my server (running or otherwise) if I didn't have an actual need for it.

2
  • Sorry I didn't think about the security concerns. I edited the answer so it's more clear.
    – kursus
    Feb 17, 2014 at 4:48
  • There is still what happens on the server to consider. Unless the server does exactly nothing, you still have user input that can take advantage of MySQL weaknesses, and it's still possible to mismanage it so that even valid commands (say, to write files or add rows to a table) can be harmful. It's no more or less harmful by itself than PHP is, really. Feb 17, 2014 at 4:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .