CVE-2017-3257: Medium severity Oracle MySQL vulnerability

Q: What is the severity of CVE-2017-3257?

CVE-2017-3257 is considered an easily exploitable vulnerability that affects certain versions of MySQL Server.

Q: How do I fix CVE-2017-3257?

To fix CVE-2017-3257, upgrade your MySQL Server to version 5.6.35 or later, or 5.7.17 or later.

Q: Which versions of MySQL are affected by CVE-2017-3257?

CVE-2017-3257 affects MySQL versions 5.6.34 and earlier, as well as 5.7.16 and earlier.

Q: Can CVE-2017-3257 be exploited remotely?

Yes, CVE-2017-3257 can be exploited by low privileged attackers with network access via multiple protocols.

Q: Is MariaDB also affected by CVE-2017-3257?

Yes, CVE-2017-3257 impacts certain versions of MariaDB, specifically those below 10.0.29, 10.1.21, and 10.2.8.

Published Jan 18, 2017

Updated

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB ). Supported versions that are affected are 5.6.34 and earlier 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

External References:

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL

Other sources

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.34 and earlier5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).

— MITRE

Affected Software

11 affected componentsFixes available

redhat/mysql<5.6.35

5.6.35

redhat/mysql<5.7.17

5.7.17

redhat/mariadb<10.0.29

10.0.29

redhat/mariadb<10.1.21

10.1.21

redhat/mariadb<10.2.8

10.2.8

Oracle MySQL>=5.6.0<=5.6.34

Oracle MySQL>=5.7.0<=5.7.16

MariaDB MariaDB>=10.0.0<10.0.29

MariaDB MariaDB>=10.1.0<10.1.21

MariaDB MariaDB>=10.2.0<10.2.8

Debian Debian Linux=8.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 5.6.35
Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 5.7.17
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.0.29
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.1.21
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.2.8
Upgrade
Upgrade Oracle MySQL Server (InnoDB) to a version that resolves this vulnerability.
Fixed in 5.6.35
Upgrade
Upgrade Oracle MySQL Server (InnoDB) to a version that resolves this vulnerability.
Fixed in 5.7.17

Event History

Jan 27, 2017

CVE Published

via MITRE·10:01 PM

Data Sourced

via MITRE·10:01 PM

DescriptionWeakness

Data Sourced

via NVD·10:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3257?

CVE-2017-3257 is considered an easily exploitable vulnerability that affects certain versions of MySQL Server.

How do I fix CVE-2017-3257?