PT-2017-1971 · Oracle+3 · Mysql Server+2

Published 2017-04-18 · Updated 2019-10-03 · CVE-2017-3452

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 5.6.35 and earlier

Description The issue is related to the MySQL Server component of Oracle MySQL, specifically with the Server: Optimizer subcomponent. It allows a low-privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. The vulnerability is easily exploitable and can be triggered remotely.

Recommendations For versions 5.6.35 and earlier, update to a version later than 5.6.35 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2018-1647

BDU:2017-01131

CVE-2017-3452

OPENSUSE-SU-2017_1209-1

RHSA-2017:2787

Affected Products

Alt Linux

Mysql Server

Suse

References · 284

• 🔥 https://github.com/SECFORCE/CVE-2017-3599/blob/master/cve-2017-3599_poc.py · Exploit
• 🔥 https://github.com/SECFORCE/CVE-2017-3599 · Exploit
• https://bdu.fstec.ru/vul/2020-00679 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0409 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0503 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2668 · Security Note
• https://bdu.fstec.ru/vul/2017-01149 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3645 · Security Note
• https://bdu.fstec.ru/vul/2020-00677 · Security Note
• https://bdu.fstec.ru/vul/2015-12166 · Security Note
• https://bdu.fstec.ru/vul/2016-01105 · Security Note
• https://bdu.fstec.ru/vul/2017-01156 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3518 · Security Note
• https://bdu.fstec.ru/vul/2015-11924 · Security Note