PT-2016-3058 · Mysql Server+6 · Mysql Server+6

Published 2016-12-24 · Updated 2023-12-29 · CVE-2017-3238

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MySQL Server versions 5.5.53 and earlier MySQL Server versions 5.6.34 and earlier MySQL Server versions 5.7.16 and earlier

Description The issue is related to inadequate access control in the MySQL Server component, specifically in the Server: Optimizer subcomponent. This allows an attacker with network access via multiple protocols to compromise the MySQL Server. Successful attacks can result in the ability to cause a hang or frequently repeatable crash of the MySQL Server, leading to a denial of service.

Recommendations For versions 5.5.53 and earlier, update to a version later than 5.5.53 to resolve the issue. For versions 5.6.34 and earlier, update to a version later than 5.6.34 to resolve the issue. For versions 5.7.16 and earlier, update to a version later than 5.7.16 to resolve the issue. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2017-1061

ALT-PU-2017-1407

BDU:2017-00243

CESA-2017_2192

CVE-2017-3238

DLA-797-1

DSA-3767-1

DSA-3770-1

MGASA-2017-0054

OPENSUSE-SU-2017_0479-1

OPENSUSE-SU-2017_0486-1

OPENSUSE-SU-2017_0618-1

RHSA-2017:2192

RHSA-2017:2787

RHSA-2017:2886

RHSA-2017_2192

RHSA-2018:0279

RHSA-2018:0574

SUSE-RU-2023:3956-1

SUSE-RU-2023:4991-1

SUSE-SU-2017:0408-1

SUSE-SU-2017:0411-1

SUSE-SU-2017:0412-1

USN-3174-1

Affected Products

Alt Linux

Centos

Mariadb Server

Mysql Server

Red Hat

Suse

Ubuntu

References · 584

• http://oracle.com/technetwork/security-advisory/cpujan2017-2881727.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3317 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3302 · Security Note
• https://security.gentoo.org/glsa/201702-18 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3291 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3312 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3313 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3770-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8327 · Vendor Advisory
• https://security.gentoo.org/glsa/201702-17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0408-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3251 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3312 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3238 · Security Note