CVE-2017-3305: Medium severity Oracle MySQL vulnerability
It was found that MySQL client when specified to use SSL/TLS mode is authenticating to MySQL server not supporting SSL/TLS, client will fallback to plain text protocol used for authentication. After successful authentication client checks if SSL/TLS layer is required and if server doesn't support it, client will close the connection with error.
Active MITM attacker can downgrade SSL/TLS to plain text and forward nonce from server back to client. MITM attacker receive login data (for server nonce) from client and send it to server to authenticate as client.
This issue is present in libmysqlclient.so in 5.5 and 5.6 versions.
Other sources
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.55 and earlier and 5.6.35 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). NOTE: the previous information is from the April 2017 CPU. Oracle has not commented on third-party claims that this issue allows man-in-the-middle attackers to hijack the authentication of users by leveraging incorrect ordering of security parameter verification in a client, aka, "The Riddle".
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mysqlto a version that resolves this vulnerability.Fixed in 5.5.55 - Upgrade
Upgrade
redhat/mysqlto a version that resolves this vulnerability.Fixed in 5.6.36 - Upgrade
Upgrade
Oracle MySQL Server (Server: C API)to a version that resolves this vulnerability.Fixed in 5.6.36
Event History
Frequently Asked Questions
What is the CVE-2017-3305 vulnerability severity?
The CVE-2017-3305 vulnerability is rated as difficult to exploit, affecting low privileged attackers with network access.
How do I fix CVE-2017-3305?
To fix CVE-2017-3305, upgrade MySQL to version 5.6.36 or later if using version 5.6, or to version 5.5.56 or later if using version 5.5.
Which versions of MySQL are affected by CVE-2017-3305?
CVE-2017-3305 affects MySQL versions 5.5.55 and earlier, and 5.6.35 and earlier.
Can CVE-2017-3305 be exploited remotely?
Yes, CVE-2017-3305 can be exploited by low privileged attackers with network access via multiple protocols.
What components of Oracle MySQL are affected by CVE-2017-3305?
CVE-2017-3305 affects the MySQL Server component, specifically the Server: C API.