Search code examples
mysqlsecuritypci-compliance

MySQL version: 5.5.36 vulnerable?

I client of ours did a PCI scan on their site and came up with the following alert:

vulnerable MySQL version: 5.5.36---Risk Level High

Is this version of MySQL in fact more vulnerable than others? Do I need to update the version (which will affect all the sites on the server) or can I tell him otherwise?

Solution

  • If an external scan is detecting MySQL, you've got huge problems. You need to firewall that service immediately.

    You should not have port 3306 open to the general public under any circumstances, especially not if you're trying to get PCI compliance.

    Firewall this service completely. If other external servers need access to this, they should do so via a VPN or SSH tunnel. Where this isn't practical, you must employ IP whitelisting at the firewall level.