Based on preliminary source inspection, I suspect that passwordless
host-based access control can be circumvented in the same way that it can
be with mSQL. There *appear* to be opportunities for buffer overflows
buried inside many of the bottom-layer functions, but I am unsure whether
some type of bounds checking is happening at a higher layer. There have
been enough changes to MySQL that I basically have to start tracing
argument passing from scratch.
Further investigation is required.
David Sacerdote
Secure Networks Inc.