CVE-2017-3464: Medium severity Oracle MySQL vulnerability

Q: What is the severity of CVE-2017-3464?

CVE-2017-3464 is considered an easily exploitable vulnerability that allows low privileged attackers with network access to perform unauthorized operations.

Q: How do I fix CVE-2017-3464?

To fix CVE-2017-3464, upgrade MySQL to version 5.5.55 or later, 5.6.36 or later, or 5.7.18 or later.

Q: Which versions of MySQL are affected by CVE-2017-3464?

The affected MySQL versions for CVE-2017-3464 include 5.5.54 and earlier, 5.6.35 and earlier, and 5.7.17 and earlier.

Q: What components are impacted by CVE-2017-3464?

CVE-2017-3464 affects the MySQL Server component, specifically within the Server: DDL subcomponent.

Q: Can MariaDB versions be affected by CVE-2017-3464?

Yes, certain versions of MariaDB are also affected by CVE-2017-3464, mainly those that are prior to 5.5.55, 10.1.23, and 10.2.6.

Published Apr 19, 2017

Updated

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

Other sources

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data.

External References:

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixMSQL

— Red Hat

Affected Software

24 affected componentsFixes available

redhat/mysql<5.5.55

5.5.55

redhat/mysql<5.6.36

5.6.36

redhat/mysql<5.7.18

5.7.18

redhat/mariadb<5.5.55

5.5.55

redhat/mariadb<10.2.6

10.2.6

redhat/mariadb<10.1.23

10.1.23

redhat/mariadb<10.0.31

10.0.31

Oracle MySQL>=5.5.0<=5.5.54

Oracle MySQL>=5.6.0<=5.6.35

Oracle MySQL>=5.7.0<=5.7.17

Debian Debian Linux=8.0

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Server Aus=7.4

redhat Enterprise Linux Server Aus=7.6

redhat Enterprise Linux Server Eus=7.4

redhat Enterprise Linux Server Eus=7.5

redhat Enterprise Linux Server Eus=7.6

redhat Enterprise Linux Server Tus=7.6

redhat Enterprise Linux Workstation=7.0

MariaDB MariaDB>=5.5.0<5.5.55

MariaDB MariaDB>=10.0.0<10.0.31

MariaDB MariaDB>=10.1.0<10.1.23

MariaDB MariaDB>=10.2.0<10.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 5.5.55
Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 5.6.36
Upgrade
Upgrade redhat/mysql to a version that resolves this vulnerability.
Fixed in 5.7.18
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 5.5.55
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.2.6
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.1.23
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.0.31
Upgrade
Upgrade oracle/mysql/MySQL Server to a version that resolves this vulnerability.
Fixed in 5.5.55
Upgrade
Upgrade oracle/mysql/MySQL Server to a version that resolves this vulnerability.
Fixed in 5.6.36
Upgrade
Upgrade oracle/mysql/MySQL Server to a version that resolves this vulnerability.
Fixed in 5.7.18

Event History

Apr 24, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3464?

CVE-2017-3464 is considered an easily exploitable vulnerability that allows low privileged attackers with network access to perform unauthorized operations.

How do I fix CVE-2017-3464?