CVE-2017-10365: Low severity Oracle MySQL vulnerability

Q: Who can exploit this issue?

Exploitation requires a high-privileged attacker with network access to the MySQL Server through multiple protocols. The issue is rated low severity because it requires high privileges, despite having low attack complexity and requiring no user interaction.

Q: What could a successful attack do?

A successful attack can allow unauthorized update, insert, or delete operations on some data accessible to MySQL Server. It can also cause a partial denial of service affecting the MySQL Server.

Q: Which MySQL versions are identified as affected?

The affected supported Oracle MySQL Server versions are 5.7.18 and earlier, in the InnoDB subcomponent.

Published Oct 18, 2017

Updated

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.

External References:

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL

Other sources

Affected Software

13 affected componentsFixes available

Oracle MySQL>=5.7.0<=5.7.18

MariaDB MariaDB>=10.2.0<10.2.8

NetApp Active Iq Unified Manager Windows>=7.3

NetApp Active Iq Unified Manager Vmware Vsphere>=9.5

NetApp OnCommand Balance

NetApp OnCommand Insight

NetApp Oncommand Performance Manager Vmware Vsphere

NetApp Oncommand Unified Manager Vsphere<=7.1

NetApp Oncommand Unified Manager Windows<=7.1

NetApp OnCommand Workflow Automation

NetApp Snapcenter

redhat/mysql<5.7.19

5.7.19

redhat/mariadb<10.2.8

10.2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 5.7.19
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.2.8

Event History

Oct 19, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Data Sourced

05:29 PM

RemedyDescriptionSeverityAffected Software

Event

05:29 PM

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires a high-privileged attacker with network access to the MySQL Server through multiple protocols. The issue is rated low severity because it requires high privileges, despite having low attack complexity and requiring no user interaction.

What could a successful attack do?

A successful attack can allow unauthorized update, insert, or delete operations on some data accessible to MySQL Server. It can also cause a partial denial of service affecting the MySQL Server.

Which MySQL versions are identified as affected?

The affected supported Oracle MySQL Server versions are 5.7.18 and earlier, in the InnoDB subcomponent.

CVE-2017-10365: Low severity Oracle MySQL vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What could a successful attack do?

Which MySQL versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could a successful attack do?

Which MySQL versions are identified as affected?