PT-2016-7898 · Oracle+7 · Mysql Server+6

Published 2016-12-24 · Updated 2024-06-15 · CVE-2017-3318

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 5.5.53 and earlier Oracle MySQL versions 5.6.34 and earlier Oracle MySQL versions 5.7.16 and earlier

Description The issue allows a high-privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. The vulnerability can also be exploited by an attacker with network access via multiple protocols, potentially causing a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Recommendations For versions 5.5.53 and earlier, update to a version later than 5.5.53 to resolve the issue. For versions 5.6.34 and earlier, update to a version later than 5.6.34 to resolve the issue. For versions 5.7.16 and earlier, update to a version later than 5.7.16 to resolve the issue. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.

Fix

Related Identifiers

ALT-PU-2017-1061

ALT-PU-2017-1407

CESA-2017_2192

CVE-2017-3318

DLA-797-1

DSA-3767-1

DSA-3770-1

MGASA-2017-0054

OPENSUSE-SU-2017_0479-1

OPENSUSE-SU-2017_0486-1

OPENSUSE-SU-2017_0618-1

OPENSUSE-SU-2024:11038-1

RHSA-2017:2192

RHSA-2017:2787

RHSA-2017:2886

RHSA-2017_2192

RHSA-2018:0279

RHSA-2018:0574

SUSE-RU-2023:3956-1

SUSE-RU-2023:4991-1

SUSE-SU-2017:0408-1

SUSE-SU-2017:0411-1

SUSE-SU-2017:0412-1

USN-3174-1

Affected Products

Alt Linux

Centos

Mariadb Server

Mysql Server

Red Hat

Suse

Ubuntu

References · 586

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3243 · Security Note
• https://ubuntu.com/security/CVE-2017-3258 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3244 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3273 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3312 · Security Note
• https://security.gentoo.org/glsa/201702-17 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3319 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3453 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3318 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00239 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3238 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2017-3318 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6664 · Security Note
• https://bdu.fstec.ru/vul/2017-01156 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3464 · Security Note