REDHAT-BUG-1414429

First published: Wed Jan 18 2017(Updated: )

It was discovered that the mysqld_safe could read ledir value - which specifies the directory where mysqld is stored - from configuration file. This could allow a user with privileges to write to some mysql configuration file - either mysql OS user, or any local OS user able to write to the config via some other way, e.g. by exploiting <a href="https://access.redhat.com/security/cve/CVE-2016-6662">CVE-2016-6662</a> - to escalate their privileges to root if mysqld_safe was run with root privileges. This problem is related to this change applied as part of the <a href="https://access.redhat.com/security/cve/CVE-2016-6662">CVE-2016-6662</a> fix: <a href="https://github.com/mysql/mysql-server/commit/684a165f28b3718160a3e4c5ebd18a465d85e97c#diff-144aa2f11374843c969d96b7b84247eaR211">https://github.com/mysql/mysql-server/commit/684a165f28b3718160a3e4c5ebd18a465d85e97c#diff-144aa2f11374843c969d96b7b84247eaR211</a> It introduced restriction that mysqld and mysqld_version options can only be specified on the command line and can not be defined in a configuration file. However, such restriction was trivial to bypass while ledir was not restricted in a similar way. Restriction for ledir was added in MySQL versions 5.5.54, 5.6.35, and 5.7.17. The following related entry can be found in the release notes: The --ledir option now is accepted only on the command line, not in option files. <a href="http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html">http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html</a> <a href="http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-35.html">http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-35.html</a> <a href="http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-17.html">http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-17.html</a> MySQL upstream commit: <a href="https://github.com/mysql/mysql-server/commit/53230ba274a37fa13d65e802c6ef3766cd0c6d91#diff-144aa2f11374843c969d96b7b84247ea">https://github.com/mysql/mysql-server/commit/53230ba274a37fa13d65e802c6ef3766cd0c6d91#diff-144aa2f11374843c969d96b7b84247ea</a> The CVE was made public via Oracle CPU January 2017: <a href="http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL">http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL</a>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/references
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2017-3291
• agent/type
• agent/last-modified-date
• agent/first-publish-date
• agent/severity
• agent/description
• agent/event
• agent/source
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• agent/softwarecombine
• vendor/mysql
• canonical/mysql (mysql-common)