Communications between the application and its database are unprotected. If both the database and the application are on the same machine, then this is not a problem: people who can snoop on local TCP connections also have extended administrative privileges on that machine, and thus have already won.
If, on the other hand, the machine that runs the application and the machine that hosts the database are distinct, then you need to add some protection layer. Typically, you would set up SSL, as @DavidHoude indicates in his answer. Alternative methods:
Install some VPN between the application server and the database host. A VPN will protect all communications between these two machines, at the OS level. Since neither the application nor the database need be aware of that protection, this may be simpler to install in your situation. IPsec should be supported natively by your OS; or you could use a dedicated product like OpenVPN.
Use physical protection: link the application server and the database server with a direct ethernet wire (no switch, no hub, just a direct link) and make sure that no evil people can physically approach that wire.