CVE-2017-3258: Input Validation

Q: What is the severity of CVE-2017-3258?

CVE-2017-3258 is classified as an easily exploitable vulnerability that affects multiple versions of MySQL Server and allows low privileged attackers network access.

Q: How do I fix CVE-2017-3258?

To fix CVE-2017-3258, upgrade to MySQL Server versions 5.5.54 or later, 5.6.35 or later, or 5.7.17 or later.

Q: Which versions of MySQL are affected by CVE-2017-3258?

CVE-2017-3258 affects MySQL versions 5.5.53 and earlier, 5.6.34 and earlier, and 5.7.16 and earlier.

Q: Is MariaDB affected by CVE-2017-3258?

Yes, MariaDB versions earlier than 5.5.54, 10.0.29, and 10.1.21 are also affected by CVE-2017-3258.

Q: What are the potential consequences of CVE-2017-3258?

Exploitation of CVE-2017-3258 can lead to unauthorized access to the MySQL server by low privileged attackers.

Published Jan 18, 2017

Updated

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL ). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

External References:

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL

Other sources

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).

— MITRE

Affected Software

25 affected componentsFixes available

redhat/mysql<5.5.54

5.5.54

redhat/mysql<5.6.35

5.6.35

redhat/mysql<5.7.17

5.7.17

redhat/mariadb<5.5.54

5.5.54

redhat/mariadb<10.1.21

10.1.21

redhat/mariadb<10.0.29

10.0.29

Oracle MySQL>=5.5.0<=5.5.53

Oracle MySQL>=5.6.0<=5.6.34

Oracle MySQL>=5.7.0<=5.7.16

MariaDB MariaDB>=5.5.0<5.5.54

MariaDB MariaDB>=10.0.0<10.0.29

MariaDB MariaDB>=10.1.0<10.1.21

Debian Debian Linux=8.0

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Eus=7.4

redhat Enterprise Linux Eus=7.5

redhat Enterprise Linux Eus=7.6

redhat Enterprise Linux Eus=7.7

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Server Aus=7.4

redhat Enterprise Linux Server Aus=7.6

redhat Enterprise Linux Server Aus=7.7

redhat Enterprise Linux Server Tus=7.6

redhat Enterprise Linux Server Tus=7.7

redhat Enterprise Linux Workstation=7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 5.5.54
Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 5.6.35
Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 5.7.17
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 5.5.54
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.1.21
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.0.29

Event History

Jan 27, 2017

CVE Published

via MITRE·10:01 PM

Data Sourced

via MITRE·10:01 PM

DescriptionWeakness

Data Sourced

via NVD·10:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3258?

CVE-2017-3258 is classified as an easily exploitable vulnerability that affects multiple versions of MySQL Server and allows low privileged attackers network access.

How do I fix CVE-2017-3258?