After security scans, products Toad Data Point, Toad Data Studio and Toad Intelligence Central are flagged with a vulnerability in embedded MySQL 5.7.37.

Embedded MySQL version 5.7.37

MySQL Vulnerability Explanation for Toad Data Point Software

Risk Assessment

The MySQL instance utilized by Toad software is configured to operate exclusively on the local system and is not exposed to the internet. This configuration significantly reduces the attack surface, as an attacker would need to compromise the host system to access the MySQL instance. If a system is already compromised, exploiting MySQL becomes a secondary concern, as the attacker would have broader control over the system. Based on this, Quest Software, in consultation with our Chief Security Officer, assesses the risk associated with this vulnerability as minimal.

Mitigation Measures

To ensure the security of the Toad software, the following measures are in place:

• Local access only: The MySQL instance is restricted to local system access, preventing external connections.
• System-level security: Standard security practices, such as firewalls, access controls, and regular system patching, further protect the environment where MySQL operates.
• Vulnerability monitoring: Quest Software employs vulnerability management scanners to monitor and evaluate cyber risks. The current MySQL configuration has been assessed and aligns with industry-standard security practices, confirming its minimal risk profile.
  
  

Future Plans

Quest Software is committed to delivering secure and up-to-date software. While the current MySQL configuration poses minimal risk, we are planning to upgrade to newer versions of MySQL in future Toad software releases. These upgrades will address any known vulnerabilities and incorporate the latest security standards. Due to the complexity of development, testing, and release cycles, an immediate update is not feasible. We will provide further details on the upgrade timeline as they become available.

Conclusion

The MySQL vulnerability flagged by security scans poses minimal risk due to its local-only configuration and the requirement for prior system compromise to exploit it. Quest Software is confident that existing mitigations ensure the security of the Toad software. We are dedicated to addressing this in future updates and are available to provide additional technical details or clarification to support your security team’s evaluation.

For further questions, please contact Quest Software Support through your case or our support portal.