PT-2018-15633 · Oracle+3 · Mysql Server+2

Publicado 2018-01-16 · Atualizado 2018-03-28 · CVE-2018-2583

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 5.6.38 and prior Oracle MySQL versions 5.7.20 and prior

Description The issue allows a high privileged attacker with network access via multiple protocols to compromise the MySQL Server, potentially causing a hang or frequently repeatable crash (complete DOS) of the server. This can significantly impact additional products, even though the vulnerability is in the MySQL Server component.

Recommendations For versions 5.6.38 and prior, update to a version later than 5.6.38 to resolve the issue. For versions 5.7.20 and prior, update to a version later than 5.7.20 to resolve the issue. As a temporary workaround, consider restricting network access to the MySQL Server until a patch is available.

Correção

Identificadores relacionados

CVE-2018-2583

OPENSUSE-SU-2018_0223-1

RHSA-2018:0586

RHSA-2018:0587

USN-3537-1

Produtos afetados

Mysql Server

Suse

Ubuntu

Referências · 81

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2600 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2665 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-2612 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-2583 · Aviso do Fabricante
• https://bugzilla.suse.com/1076369 · Nota
• https://mariadb.com/kb/en/library/security-vulnerabilities-in-oracle-mysql-that-did-not-exist-in-mariadb · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2573 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-2640 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:0587 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2668 · Nota de Segurança
• http://oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL · Nota
• https://security.netapp.com/advisory/ntap-20180117-0002 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2667 · Nota de Segurança
• http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-39.html · Nota
• https://access.redhat.com/errata/RHSA-2018:0586 · Aviso do Fabricante