CVE-2012-3441: The database creation script (module/idoutils/db/scripts/create_mysqldb.sh) in Icinga 1.7.1 grants access t...

Security readout for executives and security teams

Icinga 1.7.1 shipped a database creation script that could give the Icinga database user access to every MySQL database, not just Icinga’s. If used unchanged, a compromised or misused Icinga account could expose unrelated application data. Exposure is most likely on legacy Icinga 1.7.1 deployments where the sample MySQL creation script was run and grants were not later corrected. Systems not using this script, not using MySQL IDOUtils, or already remediated through vendor updates are less likely exposed. Treat this as a legacy configuration risk, not an internet-scale emergency. Prioritize if old Icinga deployments share a database server with sensitive business applications or customer data. Mitigation focus: Review vendor guidance and Icinga commit references before changing production grants.; Apply relevant vendor package updates, including distribution advisories such as openSUSE-SU-2012:0968.; Restrict the icinga database user to only required Icinga databases and operations..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.