PT-2016-3055 · Oracle+7 · Mysql Server+6

Published 2016-12-24 · Updated 2023-12-29 · CVE-2017-3258

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MySQL Server versions 5.5.53 and earlier MySQL Server versions 5.6.34 and earlier MySQL Server versions 5.7.16 and earlier

Description The issue exists due to insufficient input validation in the MySQL Server component, specifically in the DDL subcomponent. This allows a remote attacker to cause the server to hang or crash by sending specially crafted network packets. The vulnerability can be exploited by an attacker with network access via multiple protocols, resulting in a denial-of-service (DOS) condition.

Recommendations For MySQL Server version 5.5.53 and earlier, update to a version later than 5.5.53 to resolve the issue. For MySQL Server version 5.6.34 and earlier, update to a version later than 5.6.34 to resolve the issue. For MySQL Server version 5.7.16 and earlier, update to a version later than 5.7.16 to resolve the issue. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-1061

ALT-PU-2017-1407

BDU:2017-00232

CESA-2017_2192

CVE-2017-3258

DLA-797-1

DSA-3767-1

DSA-3770-1

MGASA-2017-0054

OPENSUSE-SU-2017_0479-1

OPENSUSE-SU-2017_0486-1

OPENSUSE-SU-2017_0618-1

RHSA-2017:2192

RHSA-2017:2787

RHSA-2017:2886

RHSA-2017_2192

RHSA-2018:0279

RHSA-2018:0574

SUSE-RU-2023:3956-1

SUSE-RU-2023:4991-1

SUSE-SU-2017:0408-1

SUSE-SU-2017:0411-1

SUSE-SU-2017:0412-1

USN-3174-1

Affected Products

Alt Linux

Centos

Mariadb Server

Mysql Server

Red Hat

Suse

Ubuntu

References · 584

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3243 · Security Note
• https://ubuntu.com/security/CVE-2017-3258 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3244 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3273 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3312 · Security Note
• https://security.gentoo.org/glsa/201702-17 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-3258 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3319 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3453 · Security Note
• https://bdu.fstec.ru/vul/2017-00239 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3238 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6664 · Security Note
• https://bdu.fstec.ru/vul/2017-01156 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3464 · Security Note
• https://osv.dev/vulnerability/SUSE-RU-2023:3956-1 · Vendor Advisory